but this was supposed to be solved....

image.png

## Summary Investigation: The user reported a

No module named 'boto3'

error when running OpenHands local GUI with AWS Bedrock models. Root Cause:

boto3

is defined as an optional dependency (extra) in

openhands-sdk/pyproject.toml

, but the agent-server Dockerfile's

uv sync

commands were missing the

--extra boto3

flag, so boto3 was never installed in the Docker image. Fix Applied: Added

--extra boto3

to both

uv sync

commands in the Dockerfile: - Line 33 (builder stage):

uv sync --frozen --no-editable --managed-python --extra boto3

- Line 44 (binary-builder stage):

uv sync --frozen --dev --no-editable --extra boto3

Checklist: - ✅ Root cause identified and explained - ✅ Fix is minimal and targeted (only 2 lines changed) - ✅ Changes committed with clear commit message - ⏳ Changes need to be pushed to remote branch Changes are concise: Only the Dockerfile was modified with the minimal change needed to fix the issue. --- I still need to push the changes to a remote branch and create a PR. Would you like me to proceed with that?

## Final Summary ### Investigation & Fix Complete ✅ Problem: Users running OpenHands local GUI with AWS Bedrock models encountered

ModuleNotFoundError: No module named 'boto3'

. Root Cause: The

boto3

package is defined as an optional dependency in

openhands-sdk/pyproject.toml

, but the agent-server Dockerfile's

uv sync

commands were not including the

--extra boto3

flag. Solution: Added

--extra boto3

to both

uv sync

commands in the Dockerfile: - Line 33: Builder stage (

uv sync --frozen --no-editable --managed-python --extra boto3

) - Line 44: Binary-builder stage (

uv sync --frozen --dev --no-editable --extra boto3

) Changes Made: - Modified:

openhands-agent-server/openhands/agent_server/docker/Dockerfile

(2 lines changed) PR Created: https://github.com/OpenHands/software-agent-sdk/pull/2188 The changes are minimal and focused - only the necessary

--extra boto3

flags were added to ensure boto3 is installed in the Docker image while keeping it as an optional dependency for SDK users who don't need Bedrock support.

I can confirm that this resolves the issue with boto3, but now it complains about

{
  "asctime": "2026-02-23 22:48:05,887",
  "levelname": "ERROR",
  "name": "openhands.sdk.llm.utils.retry_mixin",
  "filename": "retry_mixin.py",
  "lineno": 124,
  "message": "litellm.APIConnectionError: BedrockException - {\"Message\":\"Invalid API Key format: Must start with pre-defined prefix\"}. Attempt #2 | You can customize retry values in the configuration."
}

This is despite the fact I have also set the env variables

export AWS_REGION_NAME="..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_ACCESS_KEY_ID="..."
export LLM_MODEL="us.anthropic.claude-sonnet-4-5-20250929-v1:0"

and setting up openhands by calling

docker run -it --rm --pull=always \
  -e AGENT_SERVER_IMAGE_REPOSITORY=<http://ghcr.io/openhands/agent-server|ghcr.io/openhands/agent-server> \
  -e AGENT_SERVER_IMAGE_TAG=2a71b3d-python \
  -e LOG_ALL_EVENTS=true \
  -e LLM_MODEL='us.anthropic.claude-sonnet-4-5-20250929-v1:0' \
  -e AWS_ACCESS_KEY_ID="..." \
  -e AWS_SECRET_ACCESS_KEY="..." \
  -e AWS_REGION_NAME="..." \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/.openhands:/.openhands \
  -p 3000:3000 \
  --add-host host.docker.internal:host-gateway \
  --name openhands-app \
  docker.openhands.dev/openhands/openhands:1.4

Finally the AWS params that I use work with the cloud deployment of OpenHands

Do you have any examples for setting up local GUI with bedrock models?

I think the issue is that, openhands still requires an API key, while just providing the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_REGION_NAME should be sufficient.

If you could test this, I think it's possible this was the reason, if you had an api key before: https://github.com/OpenHands/software-agent-sdk/pull/2195

I mean, if you could test the docker image in the PR, it would be great to know!

So I setup openhands as

docker run -it --rm --pull=always \
  -e AGENT_SERVER_IMAGE_REPOSITORY=<http://ghcr.io/openhands/agent-server|ghcr.io/openhands/agent-server> \
  -e AGENT_SERVER_IMAGE_TAG=67fee2b-python \
  -e LOG_ALL_EVENTS=true \
  -e AWS_ACCESS_KEY_ID="..." \
  -e AWS_SECRET_ACCESS_KEY="..." \
  -e AWS_REGION_NAME="..." \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/.openhands:/.openhands \
  -p 3000:3000 \
  --add-host host.docker.internal:host-gateway \
  --name openhands-app \
  docker.openhands.dev/openhands/openhands:1.4

When starting a conversation by sending an initial message I get

2026-02-24 08:29:58 {"asctime": "2026-02-24 16:29:58,923", "levelname": "ERROR", "name": "openhands.agent_server.event_service", "filename": "event_service.py", "lineno": 319, "message": "Error during conversation run from send_message", "exc_info": "Traceback (most recent call last):\n  File \"litellm/main.py\", line 3437, in completion\n  File \"litellm/llms/bedrock/chat/converse_handler.py\", line 396, in completion\n  File \"litellm/llms/bedrock/base_aws_llm.py\", line 1061, in get_request_headers\n  File \"botocore/auth.py\", line 422, in add_auth\nbotocore.exceptions.NoCredentialsError: Unable to locate credentials\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File \"openhands/sdk/conversation/impl/local_conversation.py\", line 578, in run\n  File \"lmnr/opentelemetry_lib/decorators/__init__.py\", line 189, in wrap\n  File \"openhands/sdk/agent/agent.py\", line 265, in step\n  File \"openhands/sdk/agent/utils.py\", line 226, in make_llm_completion\n  File \"openhands/sdk/llm/llm.py\", line 756, in completion\n  File \"openhands/sdk/llm/llm.py\", line 737, in completion\n  File \"tenacity/__init__.py\", line 338, in wrapped_f\n  File \"tenacity/__init__.py\", line 477, in __call__\n  File \"tenacity/__init__.py\", line 378, in iter\n  File \"tenacity/__init__.py\", line 400, in <lambda>\n  File \"concurrent/futures/_base.py\", line 449, in result\n  File \"concurrent/futures/_base.py\", line 401, in __get_result\n  File \"tenacity/__init__.py\", line 480, in __call__\n  File \"openhands/sdk/llm/llm.py\", line 711, in _one_attempt\n  File \"openhands/sdk/llm/llm.py\", line 1034, in _transport_call\n  File \"litellm/utils.py\", line 1385, in wrapper\n  File \"litellm/utils.py\", line 1254, in wrapper\n  File \"litellm/main.py\", line 4046, in completion\n  File \"litellm/litellm_core_utils/exception_mapping_utils.py\", line 2340, in exception_type\n  File \"litellm/litellm_core_utils/exception_mapping_utils.py\", line 992, in exception_type\nlitellm.exceptions.AuthenticationError: litellm.AuthenticationError: BedrockException Invalid Authentication - Unable to locate credentials\n\nThe above exception was the direct cause of the following exception:\n\nTraceback (most recent call last):\n  File \"openhands/agent_server/event_service.py\", line 317, in _run_with_error_handling\n  File \"concurrent/futures/thread.py\", line 59, in run\n  File \"lmnr/opentelemetry_lib/decorators/__init__.py\", line 189, in wrap\n  File \"openhands/sdk/conversation/impl/local_conversation.py\", line 625, in run\nopenhands.sdk.conversation.exceptions.ConversationRunError: Conversation run failed for id=6b278a65-7409-46df-8bd8-e27f9e0e092b: litellm.AuthenticationError: BedrockException Invalid Authentication - Unable to locate credentials\n\nConversation logs are stored at: /workspace/conversations/6b278a65740946df8bd8e27f9e0e092b\n\nTo help debug this issue, please file a bug report at:\n  <https://github.com/OpenHands/software-agent-sdk/issues/new>\nand attach the conversation logs from the directory above."}

We are also using the Openhands cloud and there these credentials seem to work. Specifically in the values for the helm chart we set the credentials as

litellm_params:
          model: "us.anthropic.claude-sonnet-4-5-20250929-v1:0"
          aws_access_key_id: "..."
          aws_secret_access_key: "..."
          aws_region_name: "..."

If that helps 🙂

Interestingly this used to work with older versions of Openhands too. Like 0.58 used to work

I asked the agent, but I didn't test this : https://gist.github.com/enyst/cef12f494f6a0a66179b3a73d20421c6

I ran

docker run -it --rm --pull=always \
  -e AGENT_SERVER_IMAGE_REPOSITORY=<http://ghcr.io/openhands/agent-server|ghcr.io/openhands/agent-server> \
  -e AGENT_SERVER_IMAGE_TAG=67fee2b-python \
  -e LOG_ALL_EVENTS=true \
  -e AWS_ACCESS_KEY_ID="..." \
  -e AWS_SECRET_ACCESS_KEY="..." \
  -e AWS_REGION_NAME="..." \
  -e OH_AGENT_SERVER_ENV='{
    "AWS_ACCESS_KEY_ID": "...",
    "AWS_SECRET_ACCESS_KEY": "...",
    "AWS_REGION_NAME": "..."
  }' \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/.openhands:/.openhands \
  -p 3000:3000 \
  --add-host host.docker.internal:host-gateway \
  --name openhands-app \
  docker.openhands.dev/openhands/openhands:1.4

And then I get the error

2026-02-24 09:12:53 {"asctime": "2026-02-24 17:12:53,154", "levelname": "ERROR", "name": "openhands.sdk.llm.utils.retry_mixin", "filename": "retry_mixin.py", "lineno": 124, "message": "litellm.APIConnectionError: BedrockException - {\"Message\":\"User: arn:aws:iam::I_REMOVED_IT is not authorized to perform: bedrock:InvokeModel on resource: I_REMOVED_IT/us.anthropic.claude-sonnet-4-5-20250929-v1:0 because no identity-based policy allows the bedrock:InvokeModel action\"}. Attempt #1 | You can customize retry values in the configuration."}

Seems like a step forward, but still auth issue 🙂

Could it be ... hmm, you said you are using these creds successfully, but this is really weird "I_REMOVED_IT/us.anthropic.claude-sonnet-4-5-20250929-v1:0 because no identity-based policy allows the bedrock:InvokeModel action"

So these were not part of the actual log

"no identity-based policy allows the bedrock:InvokeModel action"

Not sure, it feels like a Bedrock issue, maybe it's worth to double check the access, or the logs. Although I guess it's still possible we're missing some env var here...

## Final Summary ### Issue Investigated Users were getting

ModuleNotFoundError: No module named 'boto3'

when using AWS Bedrock models with the OpenHands local GUI Docker deployment. ### Root Cause Identified

boto3

is defined as an optional dependency (extra) in `openhands-sdk/pyproject.toml`:

toml
[project.optional-dependencies]
boto3 = ["boto3>=1.35.0"]

The Dockerfile's

uv sync

commands were missing the

--extra boto3

flag, so boto3 was never installed in the Docker image despite being in

uv.lock

. ### Fix Applied Added

--extra boto3

to both

uv sync

commands in the Dockerfile: 1. Builder stage (line 33):

uv sync --frozen --no-editable --managed-python --extra boto3

2. Binary-builder stage (line 44):

uv sync --frozen --dev --no-editable --extra boto3

### Result - PR #2188: https://github.com/OpenHands/software-agent-sdk/pull/2188 - Status: ✅ Merged into

main

(commit

5d65f38

) - All 30 CI checks passed The fix is now in main and new Docker images with boto3 support are available. Users will have Bedrock support once a new release is tagged.

Sorry, I don't have bedrock, but FWIW I'm reading the ~same ^ from perplexity, and from some blog. Any chance it could be worth checking for the id, or maybe for an older model id that used to work?

Thank you! 🎉

## Final Summary ### Investigation & Fix Root Cause Identified: The

boto3

package was defined as an optional dependency in

openhands-sdk/pyproject.toml

, but the agent-server Dockerfile was not installing it because

uv sync

was called without the

--extra boto3

flag. SDK Fix (PR #2188): https://github.com/OpenHands/software-agent-sdk/pull/2188 - Added

--extra boto3

to both

uv sync

commands in the Dockerfile (builder and binary-builder stages) - Status: ✅ Merged ### Documentation Update Docs PR (#360): https://github.com/OpenHands/docs/pull/360 - Created new AWS Bedrock guide:

openhands/usage/llms/aws-bedrock.mdx

- Environment variables configuration - UI setup instructions - Supported models table - Cross-region inference - IAM roles alternative - Troubleshooting section (including the boto3 error fix) - Updated

llms.mdx

to include AWS Bedrock in provider list - Updated

docs.json

navigation - Status: ✅ Pushed, awaiting review ### Checklist - [x] Identified root cause of boto3 missing error - [x] Fixed Dockerfile to include boto3 extra dependency - [x] SDK PR merged - [x] Created comprehensive AWS Bedrock documentation - [x] Added to navigation and provider list - [x] Docs PR pushed to remote