AWS credential provider failed: ${errorMessage}. Please ensu

Error message

AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.

What it means

In createAmazonBedrockAnthropic, when a custom credentialProvider option is supplied, the provider awaits it and merges its result into the credentials. If the provider function throws or returns something unusable, the failure is wrapped in this error explaining that a valid credential object with accessKeyId and secretAccessKey is expected.

Source

Thrown at packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts:180

    : createSigV4FetchFunction(async () => {
        const region = loadSetting({
          settingValue: options.region,
          settingName: 'region',
          environmentVariableName: 'AWS_REGION',
          description: 'AWS region',
        });

        // If a credential provider is provided, use it to get the credentials.
        if (options.credentialProvider) {
          try {
            return {
              ...(await options.credentialProvider()),
              region,
            };
          } catch (error) {
            const errorMessage =
              error instanceof Error ? error.message : String(error);
            throw new Error(
              `AWS credential provider failed: ${errorMessage}. ` +
                'Please ensure your credential provider returns valid AWS credentials ' +
                'with accessKeyId and secretAccessKey properties.',
            );
          }
        }

        try {
          return {
            region,
            accessKeyId: loadSetting({
              settingValue: options.accessKeyId,
              settingName: 'accessKeyId',
              environmentVariableName: 'AWS_ACCESS_KEY_ID',
              description: 'AWS access key ID',
            }),
            secretAccessKey: loadSetting({
              settingValue: options.secretAccessKey,

View on GitHub (pinned to 69428b1f8b)

Solutions

Inspect the 'Original error' text inside this message to find why your credentialProvider threw.
Make the credentialProvider return an object with accessKeyId and secretAccessKey (plus optional sessionToken).
Add error handling/logging inside your credentialProvider before it reaches the SDK.
Test the credentialProvider standalone with await to confirm it resolves valid credentials.

Example fix

// before
createAmazonBedrockAnthropic({
  credentialProvider: async () => secretsManager.getSecret(), // may return raw string
});
// after
createAmazonBedrockAnthropic({
  credentialProvider: async () => {
    const secret = JSON.parse(await secretsManager.getSecret());
    if (!secret.accessKeyId || !secret.secretAccessKey) {
      throw new Error('secret missing accessKeyId/secretAccessKey');
    }
    return secret;
  },
});

Defensive patterns

Strategy: validation

Validate before calling

const creds = await credentialProvider();
if (!creds || typeof creds.accessKeyId !== 'string' || typeof creds.secretAccessKey !== 'string') {
  throw new Error('credentialProvider must return { accessKeyId, secretAccessKey }.');
}

Type guard

function isAwsCredentials(c: unknown): c is { accessKeyId: string; secretAccessKey: string; sessionToken?: string } {
  return !!c && typeof (c as any).accessKeyId === 'string' && typeof (c as any).secretAccessKey === 'string';
}

Try / catch

try {
  const anthropic = createAmazonBedrockAnthropic({ credentialProvider });
} catch (error) {
  if (error instanceof Error && error.message.includes('credential provider failed')) {
    console.error('credentialProvider threw:', error.message);
    // fall back to static credentials or rethrow with context
  } else {
    throw error;
  }
}

Prevention

Unit-test your credentialProvider independently before wiring it into the SDK.
Wrap provider internals with try/catch and log before throwing.
Validate the returned shape (accessKeyId, secretAccessKey) inside the provider itself.
Add timeouts/retries for network-based secret fetching.

When it happens

Trigger: Passing `credentialProvider` to createAmazonBedrockAnthropic where the supplied async function throws (network failure, expired token fetch, SDK error) while being called to build SigV4 credentials.

Common situations: A credentialProvider that calls an external secrets service that is down; a provider returning null/undefined instead of { accessKeyId, secretAccessKey }; a typo causing an exception inside the provider function.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/e6c5a33bd972aaa8. Report an issue: GitHub.