[cunninghamcard-bit]

Summary

Before: an Anthropic AWS credential producer (AnthropicAwsAuth::SigV4 with a future or async function) that failed was reported with its own error only: API call error: failed to resolve AWS credentials: STS denied.

After: as in @ai-sdk/anthropic-aws 2.0.63, the error says AWS credential provider failed: STS denied. Please ensure your credential provider returns valid AWS credentials with access_key_id and secret_access_key. (upstream: accessKeyId and secretAccessKey properties). Nothing is sent.

Found while porting the upstream Anthropic AWS tests (SigV4 path › wraps credential provider rejections with a guided message). Part of the #276 list.

How it works today

AnthropicAwsFetch::fetch → SigV4Fetch::fetch           aimux-providers/src/anthropic_aws/model.rs:216 / aimux-provider-utils/src/sigv4_fetch.rs:422
└─ credentials.resolve()                               the producer below, once per request
   └─ Auth::credentials                                model.rs:118
      └─ producer.resolve().await?                     :121   ← the producer's error as is
   └─ map_err → FetchError::Other("failed to resolve AWS credentials: {error}")   sigv4_fetch.rs:430
                                                         // upstream: try { await options.credentialProvider() }
                                                         //   catch → Error('AWS credential provider failed: …')  :145-160

What this PR changes

Auth::credentials                                      model.rs:118
└─ producer.resolve().await.map_err(→ AiMuxError::Other(
       "AWS credential provider failed: {error}. Please ensure your credential provider returns valid AWS credentials …"))

Tests (tests/anthropic_aws_settings_test.rs): a_failing_credential_producer_is_reported_with_guidance; on master it fails with API call error: failed to resolve AWS credentials: STS denied. The upstream case is ported in the Anthropic AWS test PR.

Docs: CHANGELOG Fixed.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change
• New provider
• New / updated binding
• Docs / RFC

Checklist

• cargo +1.99 fmt -p aimux-providers -- --check passes
• cargo +1.99 clippy -p aimux-providers --lib --tests -- -D warnings passes
• cargo +1.99 test -p aimux-providers --test anthropic_aws_settings_test passes (8)
• scripts/check_provider_boundaries.sh passes
• Updated relevant docs (CHANGELOG)
• Commit messages follow Conventional Commits

Notes for reviewers

Stacked on #316 (missing SigV4 credentials). The message still arrives inside AiMuxError::ApiCall, with failed to resolve AWS credentials: before it: the shared SigV4Fetch turns any credential failure into a transport error, for Bedrock and Polly too. Upstream throws a plain Error. Changing that is a provider-utils change for all three AWS providers, not this fix; the upstream test checks the message and passes.

---

Generated by Claude Code

[cunninghamcard-bit]

Folded into #318 together with the other Anthropic AWS fixes, so each vendor has one fix PR. This change is commit b7a53e9e there. Closing this one; the branch stays as it is.

---

Generated by Claude Code