AWS CDK "Unable to resolve AWS account to use" / no credentials in CI

By Kaveh Alemi·Latchkey

CDK needs AWS credentials to look up the account and deploy, and the default credential chain returned nothing: no env vars, no profile, and no instance/OIDC role. The CLI cannot resolve which account it is operating on.

What this error means

cdk deploy fails with "Unable to resolve AWS account to use. It must be either configured when you define your CDK Stack, or through the environment" or "Need to perform AWS calls ... but no credentials have been configured".

cdk

Unable to resolve AWS account to use. It must be either configured when you define
your CDK Stack, or through the environment

Common causes

No credential step ran before CDK

The job never configured AWS credentials, so the default chain (env, profile, role) is empty when CDK tries to resolve the account.

Region not set

Without AWS_REGION/AWS_DEFAULT_REGION, CDK cannot pick an endpoint and may fail account resolution.

How to fix it

Configure credentials before deploy

Run the AWS credentials action (OIDC preferred) so the chain is populated for the CDK steps.

.github/workflows/ci.yml

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/gha-deployer
    aws-region: us-east-1

Set account and region explicitly

Pin the environment in the stack so resolution does not depend on ambient credentials at synth time.

bin/app.ts

new MyAppStack(app, 'MyAppStack', {
  env: { account: '123456789012', region: 'us-east-1' },
});

How to prevent it

Always run a credentials step before any cdk command.
Set AWS_REGION in the job environment.
Use OIDC so credentials are present without stored secrets.

Frequently asked questions

What causes ""Unable to resolve AWS account to use""?