Developer Preview — This documentation covers the AWS SDK for Python, which is in Developer Preview and intended for evaluation and testing only. Do not use it for production workloads. For production applications, use the AWS SDK for Python (Boto3). To understand the differences between the two SDKs, see Choosing the right AWS SDK for Python.

Credential providers

Before the AWS SDK for Python can sign a request to an AWS service, it uses an identity resolver to obtain an identity. For these requests, the identity is a set of AWS credentials. A credential resolver is an identity resolver that retrieves AWS credentials from a configured source. Sources can include environment variables, an assumed IAM role, or another credential resolver. If you don't configure credentials, the SDK uses its default credential resolver chain.

This page explains how the SDK resolves credentials and how to configure credential sources. It includes the following topics:

For more information about credential resolution across AWS SDKs and tools, see Standardized credential providers in the AWS SDKs and Tools Reference Guide.

Default credential resolver chain

If you don't specify static credentials or a credential resolver when you create a client, the SDK assembles the default credential resolver chain. During assembly, credential providers inspect the available configuration and add the applicable credential resolvers to the chain. When the SDK needs credentials, the chain calls each resolver in a predefined order. It stops at the first resolver that returns valid credentials.

To use the default chain, resolve the configuration without setting the aws_credentials_identity_resolver field or any of the static credential properties:

from aws_sdk_bedrock_runtime.client import AsyncBedrockRuntimeClient
from aws_sdk_bedrock_runtime.config import AsyncBedrockRuntimeConfig


async def create_client() -> AsyncBedrockRuntimeClient:
    config = await AsyncBedrockRuntimeConfig.resolve(region="us-east-1")
    return AsyncBedrockRuntimeClient(config=config)

Credential sources

The resolvers in the default chain use two kinds of credential sources:

The chain uses a resolver for a network-based source only after you install its package. Each package registers a credential provider with the SDK. During assembly, the provider determines whether its source applies and adds the resolver to the chain. Without the package, the chain cannot include the resolver. This applies even when the source is configured in the environment or shared config file.

Each network-based source ships in a separate package:

Install the package for each source that your application uses:

python -m pip install aws-credentials-sts    # Assume role
python -m pip install aws-credentials-http   # Container credentials
python -m pip install aws-credentials-imds   # EC2 Instance Metadata Service

These packages also export resolver classes. To use a single source directly instead of the default chain, see Configure a specific credential resolver.

Credential retrieval order

Depending on your configuration, the chain can contain resolvers for the following credential sources. It calls the resolvers in this order and stops at the first one that returns valid credentials:

If no resolver returns valid credentials, the SDK raises an error when it signs the first request.

Configure a specific credential resolver

To use a particular credential source instead of the default chain, set the aws_credentials_identity_resolver configuration field to an instance of a resolver class. This gives you direct control over which source the SDK uses.

The following example uses EnvironmentCredentialsResolver, which reads credentials only from environment variables.

Imports

from aws_sdk_bedrock_runtime.client import AsyncBedrockRuntimeClient
from aws_sdk_bedrock_runtime.config import AsyncBedrockRuntimeConfig
from smithy_aws_core.identity import EnvironmentCredentialsResolver

Code

async def create_client() -> AsyncBedrockRuntimeClient:
    config = await AsyncBedrockRuntimeConfig.resolve(
        region="us-east-1",
        aws_credentials_identity_resolver=EnvironmentCredentialsResolver(),
    )
    return AsyncBedrockRuntimeClient(config=config)

The following resolvers are available:

The resolvers in smithy_aws_core.identity are built-in with every service client. A resolver imported from an aws_credentials_* module requires installing that package first, see Credential sources.

Configure static credentials

To use a specific set of credentials, provide them using the aws_access_key_id, aws_secret_access_key, and (optionally) aws_session_token configuration fields. This is useful when your application already holds credentials, such as credentials that it retrieves from a secrets manager.

Imports

from aws_sdk_bedrock_runtime.client import AsyncBedrockRuntimeClient
from aws_sdk_bedrock_runtime.config import AsyncBedrockRuntimeConfig

Code

async def create_client() -> AsyncBedrockRuntimeClient:
    config = await AsyncBedrockRuntimeConfig.resolve(
        region="us-east-1",
        aws_access_key_id=access_key_id,
        aws_secret_access_key=secret_access_key,
        aws_session_token=session_token,  # Optional; omit for long-term credentials.
    )
    return AsyncBedrockRuntimeClient(config=config)