Add better error handling for AWS Bedrock credentials

app.py

@@ -437,14 +437,22 @@ if msg:
         rewritten_msg = rewrite_message(msg, persona_name, show_rationale)
         msgs = clean_history(st.session_state.history, persona_name)
         msgs = append_user_turn(msgs, rewritten_msg)
-        txt, lat, tok, tps = chat(msgs, persona_name)
-        all_answers[persona_name] = txt
+        try:
+            txt, lat, tok, tps = chat(msgs, persona_name)
+            all_answers[persona_name] = txt
+        except ValueError as e:
+            st.error(f"❌ {str(e)}")
+            st.stop()
 
         rewritten_msg_control = rewrite_message(msg, "Control", show_rationale)
         msgs_control = clean_history(st.session_state.history, "Control")
         msgs_control = append_user_turn(msgs_control, rewritten_msg_control)
-        txt_control, lat, tok, tps = chat(msgs_control, "Arnold")
-        all_answers["Control"] = txt_control
+        try:
+            txt_control, lat, tok, tps = chat(msgs_control, "Arnold")
+            all_answers["Control"] = txt_control
+        except ValueError as e:
+            st.error(f"❌ {str(e)}")
+            st.stop()
 
         st.session_state.history.append(
             {"role": "assistant_all", "axis": "role", "content": all_answers, "is_new": True}
@@ -453,12 +461,16 @@ if msg:
         rewritten_msg = rewrite_message(msg, persona_name, show_rationale)
         msgs = clean_history(st.session_state.history, persona_name)
         msgs = append_user_turn(msgs, rewritten_msg)
-        txt, lat, tok, tps = chat(
-            msgs, "Arnold" if persona_name == "Control" else persona_name
-        )
-        st.session_state.history.append(
-            {"role": "assistant", "persona": persona_name, "content": txt, "is_new": True}
-        )
+        try:
+            txt, lat, tok, tps = chat(
+                msgs, "Arnold" if persona_name == "Control" else persona_name
+            )
+            st.session_state.history.append(
+                {"role": "assistant", "persona": persona_name, "content": txt, "is_new": True}
+            )
+        except ValueError as e:
+            st.error(f"❌ {str(e)}")
+            st.stop()
     st.rerun()
 
 

llm.py

@@ -19,12 +19,37 @@ load_dotenv()
 MODEL_STRING = "gpt-4.1-mini"  # we default on gpt-4.1-mini
 api_key = os.getenv("MODEL_API_KEY")
 client = openai.OpenAI(api_key=api_key)
-bedrock_runtime = boto3.client(
-    "bedrock-runtime", 
-    region_name="us-east-1",
-    aws_access_key_id= os.getenv("AWS_ACCESS_KEY_ID"),
-    aws_secret_access_key= os.getenv("AWS_SECRET_ACCESS_KEY")
-)
+
+# Lazy initialization of bedrock client to avoid errors if credentials are missing
+_bedrock_runtime = None
+
+def get_bedrock_client():
+    """Get or create the Bedrock runtime client with proper error handling."""
+    global _bedrock_runtime
+    if _bedrock_runtime is None:
+        aws_access_key = os.getenv("AWS_ACCESS_KEY_ID")
+        aws_secret_key = os.getenv("AWS_SECRET_ACCESS_KEY")
+        
+        if not aws_access_key or not aws_secret_key:
+            raise ValueError(
+                "AWS credentials not found. Please set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY "
+                "as secrets in Hugging Face Spaces settings."
+            )
+        
+        try:
+            _bedrock_runtime = boto3.client(
+                "bedrock-runtime", 
+                region_name="us-east-1",
+                aws_access_key_id=aws_access_key,
+                aws_secret_access_key=aws_secret_key
+            )
+        except Exception as e:
+            raise ValueError(
+                f"Failed to initialize AWS Bedrock client: {str(e)}. "
+                "Please verify your AWS credentials are valid and have Bedrock access."
+            ) from e
+    
+    return _bedrock_runtime
 
 # ──────────────────────────────────────────────────────────────
 # Model switcher
@@ -89,23 +114,37 @@ def chat(messages, persona):
             {"role": m["role"], "content": m["content"]} for m in messages
         ]
 
-        response = bedrock_runtime.invoke_model(
-            modelId=MODEL_STRING,
-            contentType="application/json",
-            accept="application/json",
-            body=json.dumps(
-                {
-                    "anthropic_version": "bedrock-2023-05-31",
-                    "system": system_prompt,
-                    "messages": claude_messages,
-                    "max_tokens": 4000,  # Much higher limit for longer responses
-                    "temperature": 0.3,  # Lower temperature for more focused responses
-                }
-            ),
-        )
+        try:
+            bedrock_runtime = get_bedrock_client()
+            response = bedrock_runtime.invoke_model(
+                modelId=MODEL_STRING,
+                contentType="application/json",
+                accept="application/json",
+                body=json.dumps(
+                    {
+                        "anthropic_version": "bedrock-2023-05-31",
+                        "system": system_prompt,
+                        "messages": claude_messages,
+                        "max_tokens": 4000,  # Much higher limit for longer responses
+                        "temperature": 0.3,  # Lower temperature for more focused responses
+                    }
+                ),
+            )
 
-        dt = time.time() - t0
-        body = json.loads(response["body"].read())
+            dt = time.time() - t0
+            body = json.loads(response["body"].read())
+        except ValueError as e:
+            # Re-raise ValueError (credential errors) as-is
+            raise
+        except Exception as e:
+            error_msg = str(e)
+            if "UnrecognizedClientException" in error_msg or "invalid" in error_msg.lower():
+                raise ValueError(
+                    f"AWS Bedrock authentication failed: {error_msg}. "
+                    "Please verify your AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY secrets "
+                    "are correct and have Bedrock access permissions."
+                ) from e
+            raise
 
         text = "".join(
             part["text"] for part in body["content"] if part["type"] == "text"
@@ -136,22 +175,36 @@ def chat(messages, persona):
                 }
             )
 
-        response = bedrock_runtime.invoke_model(
-            modelId=MODEL_STRING,
-            contentType="application/json",
-            accept="application/json",
-            body=json.dumps(
-                {
-                    "messages": ds_messages,
-                    "max_completion_tokens": 500,
-                    "temperature": 0.5,
-                    "top_p": 0.9,
-                }
-            ),
-        )
+        try:
+            bedrock_runtime = get_bedrock_client()
+            response = bedrock_runtime.invoke_model(
+                modelId=MODEL_STRING,
+                contentType="application/json",
+                accept="application/json",
+                body=json.dumps(
+                    {
+                        "messages": ds_messages,
+                        "max_completion_tokens": 500,
+                        "temperature": 0.5,
+                        "top_p": 0.9,
+                    }
+                ),
+            )
 
-        dt = time.time() - t0
-        body = json.loads(response["body"].read())
+            dt = time.time() - t0
+            body = json.loads(response["body"].read())
+        except ValueError as e:
+            # Re-raise ValueError (credential errors) as-is
+            raise
+        except Exception as e:
+            error_msg = str(e)
+            if "UnrecognizedClientException" in error_msg or "invalid" in error_msg.lower():
+                raise ValueError(
+                    f"AWS Bedrock authentication failed: {error_msg}. "
+                    "Please verify your AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY secrets "
+                    "are correct and have Bedrock access permissions."
+                ) from e
+            raise
 
         outputs = body.get("output", [])
         text_chunks = []
@@ -303,6 +356,7 @@ def check_credentials():
     if MODEL_TO_PROVIDER.get(MODEL_STRING) in bedrock_providers:
         # Test AWS Bedrock connection by trying to invoke a simple model
         try:
+            bedrock_runtime = get_bedrock_client()
             # Try a simple test invocation to verify credentials
             test_response = bedrock_runtime.invoke_model(
                 modelId="anthropic.claude-3-haiku-20240307-v1:0",