AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and

Error message

AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.
Original error: ${errorMessage}

What it means

The anthropic-sub-provider variant of error 121: the wrapped failure mentions AWS_SECRET_ACCESS_KEY or secretAccessKey, indicating the secret access key half of the SigV4 credential pair is missing. Both halves are required for signing.

Source

Thrown at packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts:228

            error instanceof Error ? error.message : String(error);
          if (
            errorMessage.includes('AWS_ACCESS_KEY_ID') ||
            errorMessage.includes('accessKeyId')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                '2. Provide accessKeyId and secretAccessKey in options\n' +
                '3. Use a credentialProvider function\n' +
                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\n' +
                `Original error: ${errorMessage}`,
            );
          }
          if (
            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
            errorMessage.includes('secretAccessKey')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                'Please ensure both credentials are provided.\n' +
                `Original error: ${errorMessage}`,
            );
          }
          throw error;
        }
      }, options.fetch);

  // Wrap with Bedrock event stream to SSE transformer for streaming support
  const fetchFunction = createAmazonBedrockAnthropicFetch(baseFetchFunction);

  const getBaseURL = (): string =>
    withoutTrailingSlash(
      options.baseURL ??
        `https://bedrock-runtime.${loadSetting({
          settingValue: options.region,
          settingName: 'region',

View on GitHub (pinned to 69428b1f8b)

Solutions

Ensure AWS_SECRET_ACCESS_KEY is set in the environment alongside AWS_ACCESS_KEY_ID.
Pass both accessKeyId and secretAccessKey options to createAmazonBedrockAnthropic.
If using a credentialProvider, verify it returns secretAccessKey too.
Check env var name typos in .env files and CI secret configuration.

Example fix

// before
AWS_ACCESS_KEY_ID=AKIA...   # secret missing in .env
// after
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=wJalr...
AWS_REGION=us-east-1

Defensive patterns

Strategy: validation

Validate before calling

if (!process.env.AWS_SECRET_ACCESS_KEY && !opts?.secretAccessKey) {
  throw new Error('AWS_SECRET_ACCESS_KEY (or secretAccessKey option) is required for Bedrock Anthropic SigV4 auth.');
}

Type guard

function hasSecretKey(o: unknown): o is { secretAccessKey: string } {
  return !!o && typeof (o as any).secretAccessKey === 'string' && (o as any).secretAccessKey.length > 0;
}

Try / catch

try {
  const anthropic = createAmazonBedrockAnthropic(options);
} catch (error) {
  if (error instanceof Error && error.message.includes('AWS_SECRET_ACCESS_KEY')) {
    console.error('Missing AWS secret access key for Bedrock Anthropic provider.');
  } else {
    throw error;
  }
}

Prevention

Keep access key ID and secret access key configured as an atomic pair everywhere.
Diff .env.example against your deployment env before deploys.
Validate secretAccessKey presence when constructing credential objects in shared helpers.

When it happens

Trigger: Calling createAmazonBedrockAnthropic with the access key ID present but the secret access key absent (env var unset, secretAccessKey option omitted, or credentialProvider omitting secretAccessKey), where the wrapped message mentions 'AWS_SECRET_ACCESS_KEY' or 'secretAccessKey'.

Common situations: Incomplete CI secrets configuration; only one variable set in .env; copying credential options between providers and dropping secretAccessKey; unlike the main provider, any unrecognized credential error is rethrown as-is (no wrapping).

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/e89d9b4049a01bea. Report an issue: GitHub.