AWS credential provider failed: ${errorMessage}. Please ensu

Error message

AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.

What it means

createBedrockMantle wraps any exception thrown while awaiting options.credentialProvider() in a descriptive Error explaining that the provider must return valid AWS credentials with accessKeyId and secretAccessKey. The original error message is embedded, so a failing STS call, network timeout, or misconfigured custom provider surfaces here.

Source

Thrown at packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts:157

        async () => {
          const region = loadSetting({
            settingValue: options.region,
            settingName: 'region',
            environmentVariableName: 'AWS_REGION',
            description: 'AWS region',
          });

          // If a credential provider is provided, use it to get the credentials.
          if (options.credentialProvider) {
            try {
              return {
                ...(await options.credentialProvider()),
                region,
              };
            } catch (error) {
              const errorMessage =
                error instanceof Error ? error.message : String(error);
              throw new Error(
                `AWS credential provider failed: ${errorMessage}. ` +
                  'Please ensure your credential provider returns valid AWS credentials ' +
                  'with accessKeyId and secretAccessKey properties.',
              );
            }
          }

          try {
            return {
              region,
              accessKeyId: loadSetting({
                settingValue: options.accessKeyId,
                settingName: 'accessKeyId',
                environmentVariableName: 'AWS_ACCESS_KEY_ID',
                description: 'AWS access key ID',
              }),
              secretAccessKey: loadSetting({
                settingValue: options.secretAccessKey,

View on GitHub (pinned to 69428b1f8b)

Solutions

Inspect the embedded 'Original error' message for the root cause (network, permissions, shape).
Ensure your credentialProvider resolves to { accessKeyId, secretAccessKey, sessionToken? }.
Await the provider correctly and add your own try/catch with logging around it before passing it in.
Fall back to the default credential chain (omit credentialProvider) if a custom one is unnecessary.

Example fix

// before
createBedrockMantle({ credentialProvider: () => sts.getCredentials() })
// after
createBedrockMantle({
  credentialProvider: async () => {
    const c = await sts.getCredentials();
    if (!c?.accessKeyId || !c?.secretAccessKey) throw new Error('incomplete creds');
    return { accessKeyId: c.accessKeyId, secretAccessKey: c.secretAccessKey, sessionToken: c.sessionToken };
  },
})

Defensive patterns

Strategy: try-catch

Validate before calling

async function safeCredentialProvider() {
  const creds = await myCredentialProvider();
  if (!creds?.accessKeyId || !creds?.secretAccessKey) {
    throw new Error('credentialProvider returned incomplete AWS credentials');
  }
  return creds;
}

Type guard

function isAwsCredentialShape(c) {
  return !!c && typeof c === 'object' && typeof c.accessKeyId === 'string' && typeof c.secretAccessKey === 'string';
}

Try / catch

try {
  const mantle = createBedrockMantle({ credentialProvider: safeCredentialProvider });
} catch (error) {
  if (error instanceof Error && error.message.startsWith('AWS credential provider failed')) {
    console.error('Credential provider threw:', error.message);
    // fall back to default chain or surface config error
  } else throw error;
}

Prevention

Test your credentialProvider in isolation before wiring it into the provider.
Verify resolved credentials include accessKeyId and secretAccessKey.
Add timeouts/retries inside the provider for IMDS/STS calls.
Prefer maintained providers from @aws-sdk/credential-providers over hand-rolled ones.

When it happens

Trigger: A custom credentialProvider function passed to createBedrockMantle (via bedrockMantle) throws or rejects — e.g. the async provider's underlying token fetch fails, or it returns an object missing the credential properties and downstream code rejects.

Common situations: Custom credential providers hitting IMDS/STS in environments without network access; a provider returning undefined credentials; typos in the returned object's property names.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/01472670ba82c03e. Report an issue: GitHub.