AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and

Error message

AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.
Original error: ${errorMessage}

What it means

A sibling of error 120: the wrapped failure mentions AWS_SECRET_ACCESS_KEY or secretAccessKey, meaning only the secret access key was missing (or the pair was incomplete). Bedrock SigV4 signing requires both an access key ID and a secret access key, so the provider explains both must be present.

Source

Thrown at packages/amazon-bedrock/src/amazon-bedrock-provider.ts:272

            error instanceof Error ? error.message : String(error);
          if (
            errorMessage.includes('AWS_ACCESS_KEY_ID') ||
            errorMessage.includes('accessKeyId')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires AWS credentials. Please provide either:\n' +
                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n' +
                '2. Provide accessKeyId and secretAccessKey in options\n' +
                '3. Use a credentialProvider function\n' +
                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\n' +
                `Original error: ${errorMessage}`,
            );
          }
          if (
            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||
            errorMessage.includes('secretAccessKey')
          ) {
            throw new Error(
              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +
                'Please ensure both credentials are provided.\n' +
                `Original error: ${errorMessage}`,
            );
          }
          // Re-throw other errors as-is
          throw error;
        }
      }, options.fetch);

  const getHeaders = () => {
    const baseHeaders = options.headers ?? {};
    return withUserAgentSuffix(baseHeaders, `ai-sdk/amazon-bedrock/${VERSION}`);
  };

  const getAmazonBedrockRuntimeBaseUrl = (): string =>
    withoutTrailingSlash(
      options.baseURL ??

View on GitHub (pinned to 69428b1f8b)

Solutions

Verify both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set in the environment.
Pass both accessKeyId and secretAccessKey in provider options — the pair, not just one.
Check for typos in env var names (e.g. AWS_SECRET_ACCESS_KEY).
If using a credentialProvider, ensure it returns an object containing both accessKeyId and secretAccessKey.

Example fix

// before
const bedrock = createAmazonBedrock({ accessKeyId: 'AKIA...' });
// after
const bedrock = createAmazonBedrock({
  accessKeyId: 'AKIA...',
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
  region: 'us-east-1',
});

Defensive patterns

Strategy: validation

Validate before calling

if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
  throw new Error('Both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be set for Bedrock SigV4.');
}

Type guard

function isCompleteCredentialPair(c): c is { accessKeyId: string; secretAccessKey: string } {
  return !!c && typeof (c as any).accessKeyId === 'string' && typeof (c as any).secretAccessKey === 'string';
}

Try / catch

try {
  const model = bedrock(modelId);
} catch (error) {
  if (error instanceof Error && error.message.includes('AWS_SECRET_ACCESS_KEY')) {
    console.error('Secret access key missing; check env var name and value.');
  } else {
    throw error;
  }
}

Prevention

Set both env vars together in shell profiles, .env files, and CI secret config.
Grep .env files for AWS_SECRET_ACCESS_KEY typos before deploying.
When sharing credential options between providers, copy the full pair.

When it happens

Trigger: Calling createAmazonBedrock with AWS_ACCESS_KEY_ID set (or accessKeyId provided) but AWS_SECRET_ACCESS_KEY / secretAccessKey absent, such that the underlying credential error message contains 'AWS_SECRET_ACCESS_KEY' or 'secretAccessKey'.

Common situations: Setting only one env var in a shell profile or CI secret store; pasting the access key ID but not the secret into options; typos like AWS_SECRET_ACCESS_KEY_ID or AWS_SECRET_ACCES_KEY.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/e585957950672e15. Report an issue: GitHub.