aws / aws/bedrock-agentcore-starter-toolkit
[BUG] bedrock-agentcore-starter-toolkit does not support named AWS profiles, causing NoCredentialsError
- Dominant language
- Python
- Stars
- 508
- Forks
- 155
- Avg merge
- 8h 50m
- Merged PRs (30d)
- 4
Description
**Describe the bug**
The bedrock-agentcore-starter-toolkit does not support using named AWS profiles and always attempts to use default AWS credentials, resulting in a NoCredentialsError
when the default profile is not configured or when users want to use a specific named profile. This affects all operations that use boto3 clients under the hood.
**To Reproduce**
Steps to reproduce the behavior:
1. Install package with uv add bedrock-agentcore-starter-toolkit
2. Configure AWS credentials using named profiles in ~/.aws/config (e.g., a custom profile)
3. Run any agentcore_runtime operation without setting default AWS credentials
4. See NoCredentialsError
**Expected behavior**
The bedrock-agentcore-starter-toolkit should support specifying named AWS profiles through a parameter (e.g., profile_name="my-profile") for all operations that use
boto3 clients, allowing users to authenticate using specific profiles instead of relying on default credentials.
**Error Output**
```
NoCredentialsError Traceback (most recent call last)
Cell In[6], line 9
5 region
7 agentcore_runtime = Runtime()
----> 9 response = agentcore_runtime.configure(
10 entrypoint="strands_claude.py",
11 execution_role=agentcore_iam_role['Role']['Arn'],
12 auto_create_ecr=True,
13 requirements_file="requirements.txt",
14 region=region,
15 agent_name=agent_name+"2"
16 )
File amazon-bedrock-agentcore-samples/.venv/lib/python3.12/site-packages/bedrock_agentcore_starter_toolkit/notebook/runtime/bedrock_agentcore.py:99, in Runtime.configure
---> 421 raise NoCredentialsError()
422 datetime_now = datetime.datetime.utcnow()
423 request.context['timestamp'] = datetime_now.strftime(SIGV4_TIMESTAMP)
NoCredentialsError: Unable to locate credentials
```
**Environment:**
• OS: Darwin 24.5.0 (macOS)
• Python version: 3.12.9
• Package version: bedrock-agentcore-starter-toolkit 0.1.0
• Installation method: uv
**Additional context**
The issue occurs throughout the codebase wherever boto3 clients are instantiated directly without session support. Key locations include:
• src/bedrock_agentcore_starter_toolkit/services/ecr.py: Uses boto3.client("sts") and boto3.client("ecr")
• src/bedrock_agentcore_starter_toolkit/services/runtime.py: Uses boto3.client("bedrock-agentcore-control") and boto3.client("bedrock-agentcore")
• src/bedrock_agentcore_starter_toolkit/operations/gateway/client.py: Uses boto3.client()
• src/bedrock_agentcore_starter_toolkit/utils/runtime/container.py: Uses boto3.Session() but doesn't accept profile parameter
All locations:
```
$ grep -riw -e "boto3\.client" -e "session(" ./bedrock-agentcore-starter-toolkit/
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/test_egress_auth.py: account_id = boto3.client("sts").get_caller_identity()["Account"]
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/test_egress_auth.py: lambda_client = boto3.client("lambda")
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/test_egress_auth.py: sts = boto3.client('sts')
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/test_egress_auth.py: s3 = boto3.client("s3")
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/test_egress_auth.py: account_id = boto3.client("sts").get_caller_identity()["Account"]
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/test_create_role.py: boto3.Session(), logging.getLogger("TestCreateRole"), role_name=f"SomeRandomName-{uid}"
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/README.md: sts = boto3.client('sts')
./bedrock-agentcore-starter-toolkit/tests_integ/gateway/test_gateway_cognito.py: account_id = boto3.client("sts").get_caller_identity()["Account"]
./bedrock-agentcore-starter-toolkit/tests/conftest.py: # Mock boto3.client calls
./bedrock-agentcore-starter-toolkit/tests/conftest.py: monkeypatch.setattr("boto3.client", mock_client)
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: @patch("boto3.client")
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: @patch("boto3.client")
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: @patch("boto3.client")
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: @patch("boto3.client")
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: with patch("boto3.client"), patch("boto3.Session"):
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: with patch("boto3.client"), patch("boto3.Session"):
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: with patch("boto3.client"), patch("boto3.Session"):
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: with patch("boto3.client"), patch("boto3.Session"):
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: with patch("boto3.client"), patch("boto3.Session"):
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: with patch("boto3.client"), patch("boto3.Session"):
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client_init.py: with patch("boto3.client"), patch("boto3.Session"):
./bedrock-agentcore-starter-toolkit/tests/operations/gateway/test_gateway_client.py: with patch("boto3.client") as mock:
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/utils/runtime/container.py: session = boto3.Session()
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/operations/gateway/client.py: self.client = boto3.client(
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/operations/gateway/client.py: self.client = boto3.client("bedrock-agentcore-control", region_name=self.region)
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/services/runtime.py: self.client = boto3.client("bedrock-agentcore-control", region_name=region, endpoint_url=control_plane_url)
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/services/runtime.py: self.dataplane_client = boto3.client("bedrock-agentcore", region_name=region, endpoint_url=data_plane_url)
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/services/ecr.py: return boto3.client("sts").get_caller_identity()["Account"]
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/services/ecr.py: return boto3.Session().region_name or "us-west-2"
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/services/ecr.py: ecr = boto3.client("ecr", region_name=region)
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/services/ecr.py: ecr = boto3.client("ecr", region_name=region)
./bedrock-agentcore-starter-toolkit/src/bedrock_agentcore_starter_toolkit/services/ecr.py: ecr = boto3.client("ecr", region_name=region)
```
The current workaround is to set AWS credentials as environment variables using AWS_PROFILE before running any agentcore commands. A comprehensive solution would
require updating all boto3 client instantiations to support named profiles through a session-based approach.
Contributor guide
Research direction
Start with the boto3 client and session call sites listed in services/ecr.py, services/runtime.py, operations/gateway/client.py, and utils/runtime/container.py. Review the existing gateway client tests and their boto3 patches in tests/operations/gateway/. Done means named AWS profiles can be specified for the affected operations and the existing default-credential behavior remains covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100