AWS SigV4 authentication requires AWS credentials. Please pr

Error message

AWS SigV4 authentication requires AWS credentials. Please provide either:
1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
2. Provide accessKeyId and secretAccessKey in options
3. Use a credentialProvider function
4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
Original error: ${errorMessage}

What it means

When SigV4 signing fails because the error message references AWS_ACCESS_KEY_ID or accessKeyId, createBedrockMantle rethrows a guided Error listing all four supported authentication mechanisms (env vars, explicit options, credentialProvider, or bearer-token API key). It exists to convert cryptic SDK credential errors into actionable setup instructions.

Source

Thrown at packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts:192

              secretAccessKey: loadSetting({
                settingValue: options.secretAccessKey,
                settingName: 'secretAccessKey',
                environmentVariableName: 'AWS_SECRET_ACCESS_KEY',
                description: 'AWS secret access key',
              }),
              sessionToken: loadOptionalSetting({
                settingValue: options.sessionToken,
                environmentVariableName: 'AWS_SESSION_TOKEN',
              }),
            };
          } catch (error) {
            const errorMessage =
              error instanceof Error ? error.message : String(error);
            if (
              errorMessage.includes('AWS_ACCESS_KEY_ID') ||
              errorMessage.includes('accessKeyId')
            ) {
              throw new Error(
                'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                  '2. Provide accessKeyId and secretAccessKey in options\n' +
                  '3. Use a credentialProvider function\n' +
                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\n' +
                  `Original error: ${errorMessage}`,
              );
            }
            if (
              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
              errorMessage.includes('secretAccessKey')
            ) {
              throw new Error(
                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                  'Please ensure both credentials are provided.\n' +
                  `Original error: ${errorMessage}`,
              );
            }

View on GitHub (pinned to 69428b1f8b)

Solutions

Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (plus AWS_REGION) in the environment.
Pass accessKeyId/secretAccessKey explicitly in createBedrockMantle options for local dev.
Supply a credentialProvider function (e.g. from @aws-sdk/credential-providers, like fromNodeProviderChain).
Alternatively authenticate with AWS_BEARER_TOKEN_BEDROCK env var or the apiKey option.
If credentials exist, verify the region is set — a missing region can also break credential resolution.

Example fix

// before
const mantle = createBedrockMantle({});
// after
const mantle = createBedrockMantle({
  region: 'us-east-1',
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
});

Defensive patterns

Strategy: validation

Validate before calling

function assertAwsAuthConfigured() {
  const hasEnv = !!process.env.AWS_ACCESS_KEY_ID && !!process.env.AWS_SECRET_ACCESS_KEY;
  const hasBearer = !!process.env.AWS_BEARER_TOKEN_BEDROCK;
  if (!hasEnv && !hasBearer) {
    throw new Error('Configure AWS credentials (env, options, credentialProvider) or a Bedrock bearer token before calling.');
  }
}

Type guard

function hasAwsCredentials(opts) {
  return Boolean((opts.accessKeyId && opts.secretAccessKey) || opts.credentialProvider || process.env.AWS_ACCESS_KEY_ID || process.env.AWS_BEARER_TOKEN_BEDROCK);
}

Try / catch

try {
  return await generateText({ model: mantle(modelId), prompt });
} catch (error) {
  if (error instanceof Error && error.message.includes('AWS SigV4 authentication requires AWS credentials')) {
    console.error('No AWS credentials found. Set env vars, pass options, or use a credentialProvider.');
  }
  throw error;
}

Prevention

Fail fast at app startup when no AWS auth mechanism is configured.
Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION in every environment (local, CI, deploy).
Use a credentialProvider (fromNodeProviderChain) so all standard AWS sources are checked.
Never rely on implicit defaults in ephemeral/container environments.

When it happens

Trigger: Calling bedrockMantle(...).create... without any AWS credentials configured: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no accessKeyId/secretAccessKey options, no credentialProvider, and no AWS_BEARER_TOKEN_BEDROCK/apiKey.

Common situations: Deploying to containers/serverless without the AWS credential chain populated; running locally without ~/.aws/credentials or env vars; CI jobs missing secrets.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/c12bdb451ef6b9a8. Report an issue: GitHub.