AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and

Error message

AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.
Original error: ${errorMessage}

What it means

When the SigV4 signing error message references AWS_SECRET_ACCESS_KEY or secretAccessKey, createBedrockMantle rethrows an Error stating that BOTH AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are required. This catches the partial-credential case where only one of the pair is present.

Source

Thrown at packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts:205

              error instanceof Error ? error.message : String(error);
            if (
              errorMessage.includes('AWS_ACCESS_KEY_ID') ||
              errorMessage.includes('accessKeyId')
            ) {
              throw new Error(
                'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                  '2. Provide accessKeyId and secretAccessKey in options\n' +
                  '3. Use a credentialProvider function\n' +
                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\n' +
                  `Original error: ${errorMessage}`,
              );
            }
            if (
              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
              errorMessage.includes('secretAccessKey')
            ) {
              throw new Error(
                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                  'Please ensure both credentials are provided.\n' +
                  `Original error: ${errorMessage}`,
              );
            }
            throw error;
          }
        },
        options.fetch,
        'bedrock-mantle',
      );

  const getBaseURL = (): string =>
    withoutTrailingSlash(
      options.baseURL ??
        `https://bedrock-mantle.${loadSetting({
          settingValue: options.region,
          settingName: 'region',

View on GitHub (pinned to 69428b1f8b)

Solutions

Verify both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set — print their presence (not values) at startup.
Fix variable-name typos in .env / CI secret configuration.
Pass both accessKeyId and secretAccessKey explicitly in createBedrockMantle options.
Use a credentialProvider (e.g. fromNodeProviderChain) to resolve the full pair atomically.
Check .env loading — ensure the file is actually read and not shadowed by an incomplete environment.

Example fix

// before (.env)
AWS_SECRET_ACCESS_KEY=xxxx
// after (.env)
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=xxxx
AWS_REGION=us-east-1

Defensive patterns

Strategy: validation

Validate before calling

function assertBothAwsKeysPresent() {
  const hasId = !!process.env.AWS_ACCESS_KEY_ID;
  const hasSecret = !!process.env.AWS_SECRET_ACCESS_KEY;
  if (hasSecret !== hasId) {
    throw new Error(`Partial AWS credentials: AWS_ACCESS_KEY_ID=${hasId}, AWS_SECRET_ACCESS_KEY=${hasSecret}. Both are required.`);
  }
}

Type guard

function hasCompleteStaticAwsCredentials(c) {
  return typeof c?.accessKeyId === 'string' && c.accessKeyId.length > 0 && typeof c?.secretAccessKey === 'string' && c.secretAccessKey.length > 0;
}

Try / catch

try {
  return await generateText({ model: mantle(modelId), prompt });
} catch (error) {
  if (error instanceof Error && error.message.includes('requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY')) {
    console.error('Only one of the AWS credential pair is set; check env vars and secret injection.');
  }
  throw error;
}

Prevention

Check the credential pair (not just one variable) during startup health checks.
Beware variable-name typos: AWS_ACCESS_KEY_ID, not AWS_ACCESS_KEY or AWS_ACCESS_KEYID.
Inject both secrets together from your secrets manager.
Prefer a credentialProvider that resolves the full credential object atomically.

When it happens

Trigger: Only AWS_SECRET_ACCESS_KEY (or only its option counterpart) is provided while AWS_ACCESS_KEY_ID is missing, so the signer complains about incomplete credentials.

Common situations: Secrets managers injecting only the secret key; a typo like AWS_ACCESS_KEY or AWS_ACCESS_KEYID; one variable overwritten in a .env file; partial secrets in CI configuration.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/5b0ec7049ade57a8. Report an issue: GitHub.