warpdotdev/warp · error · anyhow::Error

Bedrock access key secrets require --access-key-id, --secret

Error message

Bedrock access key secrets require --access-key-id, --secret-access-key, and --region in non-interactive mode

What it means

The access-key-id leg of read_bedrock_access_key_secret_value: for Bedrock access-key secrets the three required fields are prompted interactively when flags are missing, but in non-interactive mode (stdin not a terminal) a missing/empty --access-key-id aborts with NON_INTERACTIVE_REQUIRED_MSG. The shared message names all three required flags; --session-token is intentionally omitted because it is optional.

Source

Thrown at app/src/ai/agent_sdk/secret.rs:741

///
/// `session_token` is optional: if the user passes an empty `--session-token`
/// value or hits Enter at the interactive prompt, no session token is stored.
/// This supports persistent IAM credentials, which do not require a session token.
fn read_bedrock_access_key_secret_value(
    access_key_id: Option<String>,
    secret_access_key: Option<String>,
    session_token: Option<String>,
    region: Option<String>,
) -> Result<Option<ManagedSecretValue>> {
    // Error message used for all three required fields when running non-interactively.
    // --session-token is intentionally omitted because it is optional.
    const NON_INTERACTIVE_REQUIRED_MSG: &str = "Bedrock access key secrets require --access-key-id, --secret-access-key, and --region in non-interactive mode";

    let access_key_id = match access_key_id {
        Some(v) if !v.is_empty() => v,
        _ => {
            if !io::stdin().is_terminal() {
                return Err(anyhow::anyhow!(NON_INTERACTIVE_REQUIRED_MSG));
            }
            match inquire::Text::new("AWS Access Key ID:").prompt() {
                Ok(value) if !value.is_empty() => value,
                Ok(_) => return Ok(None),
                Err(InquireError::OperationCanceled | InquireError::OperationInterrupted) => {
                    return Ok(None);
                }
                Err(err) => return Err(err.into()),
            }
        }
    };

    let secret_access_key = match secret_access_key {
        Some(v) if !v.is_empty() => v,
        _ => {
            if !io::stdin().is_terminal() {
                return Err(anyhow::anyhow!(NON_INTERACTIVE_REQUIRED_MSG));
            }

View on GitHub (pinned to e72fd7aacb)

Solutions

1. Pass all three required flags non-empty: --access-key-id, --secret-access-key, and --region (plus optional --session-token)
2. Run interactively to be prompted field by field
3. Fail fast in scripts when any of the three env vars is unset or empty

Example fix

# before
oz secret create aws --secret-access-key "$SK" --region us-east-1
# Error: Bedrock access key secrets require --access-key-id, --secret-access-key, and --region in non-interactive mode

# after
oz secret create aws --access-key-id "$AKID" --secret-access-key "$SK" --region us-east-1

let need = [access_key_id.as_deref(), secret_access_key.as_deref(), region.as_deref()]
    .iter()
    .any(|v| v.map_or(true, |s| s.is_empty()));
if need && !std::io::stdin().is_terminal() {
    anyhow::bail!("non-interactive Bedrock access-key create requires --access-key-id, --secret-access-key, --region");
}

When it happens

Trigger: Creating a Bedrock access-key secret in CI/pipe without a non-empty --access-key-id (regardless of the other flags).

Common situations: CI provisioning with one of three env vars unset; empty-string flag values; migrating from a raw secret where only --value was needed.

Related errors

• Bedrock secrets require --bedrock-api-key and --region in no
• Secret name is required. Usage: oz secret create <NAME>
• Refusing to delete secret without confirmation in non-intera
• Bedrock access key secrets cannot be updated via `--value`;
• Bedrock API key secrets cannot be updated via `--value`; re-

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/411db54fccf9d036. Report an issue: GitHub.