AWS credential provider failed: ${errorMessage}. Please ensu

Error message

AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.

What it means

`createAnthropicAws` supports an optional `credentialProvider` function for AWS credentials. If that provider function throws or returns an invalid value while building the SigV4 signing credentials, the library wraps the failure in this error, preserving the original message and instructing that accessKeyId/secretAccessKey must be present.

Source

Thrown at packages/anthropic-aws/src/anthropic-aws-provider.ts:152

    ? createApiKeyFetchFunction(apiKey, options.fetch)
    : createSigV4FetchFunction(async () => {
        const region = loadSetting({
          settingValue: options.region,
          settingName: 'region',
          environmentVariableName: 'AWS_REGION',
          description: 'AWS region',
        });

        if (options.credentialProvider) {
          try {
            return {
              ...(await options.credentialProvider()),
              region,
            };
          } catch (error) {
            const errorMessage =
              error instanceof Error ? error.message : String(error);
            throw new Error(
              `AWS credential provider failed: ${errorMessage}. ` +
                'Please ensure your credential provider returns valid AWS credentials ' +
                'with accessKeyId and secretAccessKey properties.',
            );
          }
        }

        try {
          return {
            region,
            accessKeyId: loadSetting({
              settingValue: options.accessKeyId,
              settingName: 'accessKeyId',
              environmentVariableName: 'AWS_ACCESS_KEY_ID',
              description: 'AWS access key ID',
            }),
            secretAccessKey: loadSetting({
              settingValue: options.secretAccessKey,

View on GitHub (pinned to 69428b1f8b)

Solutions

Fix the credentialProvider so it resolves to `{ accessKeyId, secretAccessKey, sessionToken? }` — inspect the 'Original error' portion of the message.
Return null/undefined-safe behavior: if credentials can't be obtained, rely on default env credentials instead of throwing.
Test the provider in isolation: `await credentialProvider()` should yield valid credentials.
Check upstream token sources (SSO login, instance metadata) the provider depends on.

Example fix

// before
createAnthropicAws({ credentialProvider: async () => undefined });
// after
createAnthropicAws({
  credentialProvider: async () => ({
    accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
  }),
});

Defensive patterns

Strategy: validation

Validate before calling

const creds = await credentialProvider();
if (!creds || typeof creds.accessKeyId !== 'string' || typeof creds.secretAccessKey !== 'string') {
  throw new Error('credentialProvider must return accessKeyId and secretAccessKey');
}

Type guard

function hasAwsCreds(v: unknown): v is { accessKeyId: string; secretAccessKey: string; sessionToken?: string } {
  return !!v && typeof v === 'object' && typeof (v as any).accessKeyId === 'string' && typeof (v as any).secretAccessKey === 'string';
}

Try / catch

try {
  const model = anthropicAws('claude-...');
} catch (e) {
  if (e instanceof Error && e.message.startsWith('AWS credential provider failed:')) {
    console.error('Credential provider issue:', e.message);
  }
  throw e;
}

Prevention

Unit-test your credentialProvider resolves valid credentials before deploying.
Return credentials synchronously available or handle async token refresh upstream.
Keep SSO/temporary token sources fresh.
Prefer built-in env credential resolution when a custom provider adds no value.

When it happens

Trigger: Passing `options.credentialProvider` to `createAnthropicAws({ credentialProvider })` where the async function throws (network/STS failure) or resolves to an object missing `accessKeyId`/`secretAccessKey`, during credential resolution for a request.

Common situations: Custom credential providers hitting expired SSO/token endpoints; returning `undefined` when no credentials found; fromIni/fromTemporaryCredentials misconfiguration; region-credential resolution races.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/e98f177e1e2bdca9. Report an issue: GitHub.