vercel/ai · error · Error

AWS credential provider failed: ${errorMessage}. Please ensu

Error message

AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.

What it means

When bedrockOptions is created with a custom credentialProvider (an AWS credential provider chain function), createAmazonBedrock resolves it at client creation. If the provider throws or returns something invalid, the SDK wraps the failure in this descriptive error, telling you the provider must yield accessKeyId and secretAccessKey. It surfaces misconfigured or failing credential resolution.

Source

Thrown at packages/amazon-bedrock/src/amazon-bedrock-provider.ts:219

        const region = loadSetting({
          settingValue: options.region,
          settingName: 'region',
          environmentVariableName: 'AWS_REGION',
          description: 'AWS region',
        });

        // If a credential provider is provided, use it to get the credentials.
        if (options.credentialProvider) {
          try {
            return {
              ...(await options.credentialProvider()),
              region,
            };
          } catch (error) {
            // Error handling for credential provider failures
            const errorMessage =
              error instanceof Error ? error.message : String(error);
            throw new Error(
              `AWS credential provider failed: ${errorMessage}. ` +
                'Please ensure your credential provider returns valid AWS credentials ' +
                'with accessKeyId and secretAccessKey properties.',
            );
          }
        }

        // Enhanced error handling for SigV4 credential loading
        try {
          return {
            region,
            accessKeyId: loadSetting({
              settingValue: options.accessKeyId,
              settingName: 'accessKeyId',
              environmentVariableName: 'AWS_ACCESS_KEY_ID',
              description: 'AWS access key ID',
            }),
            secretAccessKey: loadSetting({

View on GitHub (pinned to 69428b1f8b)

Solutions

1. Log/inspect the underlying cause in the error message (it includes the original provider error) and fix that root cause
2. Verify your credential provider returns { accessKeyId, secretAccessKey, sessionToken? } — test it standalone
3. Check AWS env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) or instance role configuration
4. Re-authenticate (aws sso login / refresh tokens) or fall back to the default AWS credential chain by omitting the custom provider

Example fix

// before
createAmazonBedrock({ bedrockOptions: { region: 'us-east-1', credentialProvider: async () => ({ accessKeyId: process.env.KEY }) } });
// after
createAmazonBedrock({ bedrockOptions: { region: 'us-east-1', credentialProvider: async () => ({ accessKeyId: process.env.AWS_ACCESS_KEY_ID!, secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!, sessionToken: process.env.AWS_SESSION_TOKEN }) } });

const creds = await credentialProvider();
if (!creds?.accessKeyId || !creds?.secretAccessKey) {
  throw new Error('Credential provider returned incomplete AWS credentials');
}

function hasAwsCreds(c: unknown): c is { accessKeyId: string; secretAccessKey: string; sessionToken?: string } {
  return typeof c === 'object' && c !== null &&
    typeof (c as any).accessKeyId === 'string' && typeof (c as any).secretAccessKey === 'string';
}

try {
  const provider = createAmazonBedrock({ bedrockOptions: { region, credentialProvider } });
} catch (e) {
  // message includes the underlying provider failure — log and fall back to default chain
}

When it happens

Trigger: Passing `bedrockOptions.credentialProvider` (or an equivalent custom credential function) that throws — e.g. reading a missing env var, expired SSO/token, network failure fetching instance-profile creds — or returning an object lacking accessKeyId/secretAccessKey.

Common situations: AWS_SESSION_TOKEN/keys not set in the environment; ECS/EC2 instance role unavailable; expired SSO session; a custom async provider that returns undefined; typo in credential property names.

Related errors

• AWS credential provider failed: ${errorMessage}. Please ensu
• AWS SigV4 authentication requires AWS credentials. Please pr
• AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and
• AWS SigV4 authentication requires AWS credentials. Please pr
• AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/f6c57327ce599838. Report an issue: GitHub.