_runheed
Sign in

CredentialsProviderError: Could not load credentials from any providers

Node.js · updated 2026-11-04

Thrown by the AWS SDK for JavaScript v3 on the first call that needs to sign a request, after its default chain finds nothing: environment variables, SSO, a web identity token file, ~/.aws/credentials and ~/.aws/config, a credential process, then the container or EC2 instance metadata endpoint. It usually works on a laptop (a local profile) and fails in a container or CI.

CredentialsProviderError: Could not load credentials from any providers
    at /app/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js:135:13
    at /app/node_modules/@smithy/property-provider/dist-cjs/index.js:97:33
    at async coalesceProvider (/app/node_modules/@smithy/core/dist-cjs/index.js:1192:18)
    at async S3Client.send (/app/node_modules/@smithy/smithy-client/dist-cjs/index.js:173:13)

Quick fix

In production, give the workload an IAM role: an ECS task role, an EKS service account role, or an EC2 instance profile; the SDK picks it up with no code change. For other hosts, set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (plus AWS_REGION) in the environment that starts the process. If AWS_PROFILE is set, either remove it or make sure that profile exists on the machine: with AWS_PROFILE set the SDK skips the environment keys.

  1. Check where the code runs (container, Lambda, EC2, another cloud, CI) and which credential source is meant to apply there.
  2. AWS compute: attach an IAM role to the task, pod service account or instance instead of shipping keys.
  3. Elsewhere: set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_REGION in the deploy environment (a secret manager, not the image).
  4. Unset AWS_PROFILE on servers unless ~/.aws/config with that profile is present: it makes the SDK skip the env keys.
  5. Docker on EC2 with IMDSv2: raise the instance metadata hop limit to 2 so containers can reach the instance role.
typescript
import { S3Client } from '@aws-sdk/client-s3';

// No credentials in code: the SDK's default chain finds the role or env keys.
export const s3 = new S3Client({ region: process.env.AWS_REGION });

// Fail at startup with a clear message instead of on the first request
if (!process.env.AWS_REGION) throw new Error('AWS_REGION is not set');

Why it happens

Keys only on the developer machine

Locally the SDK reads ~/.aws/credentials; the container or CI runner has no such file and no env keys.

AWS_PROFILE set on the server

When AWS_PROFILE is set, the default chain skips the environment-variable keys and looks for that profile in ~/.aws files, which usually don't exist on a server.

No role attached

An ECS task without a task role, a pod without an IRSA service account, or an EC2 instance without an instance profile has nothing for the metadata provider to return.

Instance metadata unreachable

Containers on EC2 with IMDSv2 and the default hop limit of 1 cannot reach the metadata endpoint, so the instance role is never found.

Other fixes

  • Prefer roles over long-lived keys: they rotate automatically and there is nothing to leak.
  • For local development, aws sso login with a named profile keeps keys off disk.

Same error, other wording

  • CredentialsProviderError: AWS_PROFILE is set, skipping fromEnv provider.
  • Error: Region is missing
  • ExpiredToken: The security token included in the request is expired

Let your coding agent catch the next one

Runheed records this error in production with the stack trace, the breadcrumbs before it and the agent session that shipped the code, and serves it to Claude Code, Cursor or any MCP client. With it connected, you can ask:

> Find the "Could not load credentials from any providers" errors in production, tell me where the code runs and which credential source it should use there, and fix the deployment config (role or env) without putting keys in the code.

Plans from $29/moSee what your agent readsSee the setupCancel any time from the billing portal

Related errors

More in Memory, async and the process

References: AWS docs: setting credentials in Node.js (SDK v3), AWS SDK v3 source: default credential provider chain, AWS docs: configure instance metadata options (hop limit)