AWS SigV4 authentication requires AWS credentials. Please pr

Error message

AWS SigV4 authentication requires AWS credentials. Please provide either:
1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
2. Provide accessKeyId and secretAccessKey in options
3. Use a credentialProvider function
4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
Original error: ${errorMessage}

What it means

createAmazonBedrock wraps low-level credential resolution failures into this descriptive error. When the AWS SigV4 signing path cannot find credentials (its message mentions AWS_ACCESS_KEY_ID or accessKeyId), the provider rethrows with a checklist of all four supported authentication methods. It exists so developers see every valid way to supply Bedrock credentials instead of a cryptic SDK error.

Source

Thrown at packages/amazon-bedrock/src/amazon-bedrock-provider.ts:259

              description: 'AWS secret access key',
            }),
            sessionToken:
              options.accessKeyId != null && options.secretAccessKey != null
                ? options.sessionToken
                : loadOptionalSetting({
                    settingValue: options.sessionToken,
                    environmentVariableName: 'AWS_SESSION_TOKEN',
                  }),
          };
        } catch (error) {
          // Provide helpful error message for missing AWS credentials
          const errorMessage =
            error instanceof Error ? error.message : String(error);
          if (
            errorMessage.includes('AWS_ACCESS_KEY_ID') ||
            errorMessage.includes('accessKeyId')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                '2. Provide accessKeyId and secretAccessKey in options\n' +
                '3. Use a credentialProvider function\n' +
                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\n' +
                `Original error: ${errorMessage}`,
            );
          }
          if (
            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
            errorMessage.includes('secretAccessKey')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                'Please ensure both credentials are provided.\n' +
                `Original error: ${errorMessage}`,
            );
          }

View on GitHub (pinned to 69428b1f8b)

Solutions

Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.
Pass accessKeyId/secretAccessKey explicitly in createAmazonBedrock options.
Supply a credentialProvider function returning valid AWS credentials.
Alternatively use API key auth via AWS_BEARER_TOKEN_BEDROCK env var or the apiKey option.

Example fix

// before
const bedrock = createAmazonBedrock();
const model = bedrock('anthropic.claude-3-sonnet-20240229-v1:0');
// after (option A: env)
process.env.AWS_ACCESS_KEY_ID = '...';
process.env.AWS_SECRET_ACCESS_KEY = '...';
const bedrock = createAmazonBedrock({ region: 'us-east-1' });
// after (option B: explicit)
const bedrock = createAmazonBedrock({
  region: 'us-east-1',
  accessKeyId: '...',
  secretAccessKey: '...',
});

Defensive patterns

Strategy: validation

Validate before calling

function assertBedrockCredentials(opts) {
  const hasEnv = !!process.env.AWS_ACCESS_KEY_ID && !!process.env.AWS_SECRET_ACCESS_KEY;
  const hasOpts = !!opts?.accessKeyId && !!opts?.secretAccessKey;
  const hasProvider = typeof opts?.credentialProvider === 'function';
  const hasApiKey = !!opts?.apiKey || !!process.env.AWS_BEARER_TOKEN_BEDROCK;
  if (!hasEnv && !hasOpts && !hasProvider && !hasApiKey) {
    throw new Error('No Bedrock credentials: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, pass accessKeyId/secretAccessKey, credentialProvider, or apiKey.');
  }
}

Type guard

function hasAwsCredentials(o): o is { accessKeyId: string; secretAccessKey: string } {
  return !!o && typeof (o as any).accessKeyId === 'string' && typeof (o as any).secretAccessKey === 'string';
}

Try / catch

try {
  const model = bedrock(modelId);
} catch (error) {
  if (error instanceof Error && error.message.includes('SigV4 authentication')) {
    // prompt user / load credentials from secret manager, then retry
  } else {
    throw error;
  }
}

Prevention

Load credentials in one bootstrap module and validate them at startup before creating models.
Check env vars in CI with an early fail-fast step.
Prefer explicit options or credentialProvider over implicit ambient resolution.
Never commit credentials; inject via environment/secrets manager.

When it happens

Trigger: Calling createAmazonBedrock()/bedrock(modelId) without any credentials: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no accessKeyId/secretAccessKey options, no credentialProvider option, and no apiKey/AWS_BEARER_TOKEN_BEDROCK — while the underlying credential loader throws a message containing 'AWS_ACCESS_KEY_ID' or 'accessKeyId'.

Common situations: Running locally without AWS env vars configured; CI environments missing AWS secrets; constructing the provider in code that assumes ambient AWS SDK credential chain resolution; accidentally destructuring/omitting the credentials option.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/0c86008897464240. Report an issue: GitHub.