AWS CLI "Unable to locate credentials" - Fix Auth in CI

By Kaveh Alemi·Latchkey

The AWS CLI/SDK found no credentials anywhere in its provider chain - no environment variables, no assumed OIDC role, no usable profile. The runner is not authenticated to AWS at all.

What this error means

Any aws command fails with Unable to locate credentials. It happens before any API call. Common in CI when the credential-configuration step was skipped, failed, or ran in a different job than the one calling aws.

Terminal

Unable to locate credentials. You can configure credentials by running
"aws configure".

Common causes

No credentials configured for the job

No AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, no OIDC role assumed, and no profile present. Each CI job is isolated, so credentials set in one job do not carry to another.

Wrong or missing profile

A command references --profile foo (or AWS_PROFILE=foo) that does not exist on the runner, so the chain finds nothing.

How to fix it

Assume a role via OIDC (recommended)

Use GitHub’s OIDC to assume an IAM role - no long-lived keys to store.

.github/workflows/deploy.yml

permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::1234567890:role/ci-deploy
      aws-region: us-east-1
  - run: aws sts get-caller-identity

Configure credentials in the same job

Set the credential step in the same job as every aws call - credentials do not cross jobs.
Verify early with aws sts get-caller-identity.
If using a profile, ensure it is actually written on the runner and referenced correctly.

How to prevent it

Prefer OIDC role assumption over stored access keys.
Put the credential step and the aws calls in the same job.
Add an early aws sts get-caller-identity assertion.

Frequently asked questions

What causes ""Unable to locate credentials""?

No AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, no OIDC role assumed, and no profile present. Each CI job is isolated, so credentials set in one job do not carry to another.

How do I fix "Unable to locate credentials"?