Unable to locate credentials (boto3 / DynamoDB)

TL;DR — boto3/botocore walked its whole credential provider chain — env vars, shared ~/.aws/credentials, config profile, container/instance role — and found nothing. No credentials means it can't sign the DynamoDB request. Give the chain a credential source it can find: aws configure, env vars, a profile, or an IAM role.

What it means

botocore.exceptions.NoCredentialsError: Unable to locate credentials

Before any DynamoDB call, the SDK must resolve an access key + secret to sign the request with SigV4. This error is raised at that step: no credential provider returned anything. It happens before the request is sent. This is the absence of any identity, not a permissions denial (that would be AccessDeniedException).

Why it happens

No credentials configured — aws configure was never run and no ~/.aws/credentials exists.
Env vars missing — AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY aren't set in the process's environment (common in cron jobs, containers, CI).
Wrong or missing profile — you referenced --profile foo (or AWS_PROFILE=foo) but that profile isn't in the credentials/config file.
No instance/container role — on EC2/ECS/Lambda without an attached IAM role, so the metadata provider returns nothing.
Different user's home — running as a service account whose ~/.aws doesn't hold the file you edited.
Session token expired/absent for a temporary-credentials setup.

How to fix it

Configure a profile for local dev:

aws configure     # writes ~/.aws/credentials + ~/.aws/config

Or set env vars for the process:

export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_DEFAULT_REGION=us-east-1

On EC2/ECS/Lambda, attach an IAM role — the SDK picks it up automatically from instance/container metadata; don't bake keys in.
Verify the identity resolves before running your code:
```
aws sts get-caller-identity
```
Point at the right profile — pass profile_name to boto3.Session(...) or set AWS_PROFILE.
Against DynamoDB Local, any placeholder keys work — pass dummy aws_access_key_id/aws_secret_access_key so the chain isn't empty.

DynoTable + Local

DynoTable resolves credentials the same way as the CLI — if it connects but boto3 does not, your process is reading a different home directory or missing AWS_PROFILE. Configure profiles under Settings → Profiles and run Test Connection; switch with ⌘P.

For Local, add a profile with dummy keys and endpoint http://localhost:8000. See Connect to AWS and Install. Confirm with a test query in the Query Builder.

Sources

Credentials — Boto3 documentation (verified 2026-07-13)
Error handling — Boto3 documentation (verified 2026-07-13)

FAQ

How do I fix "Unable to locate credentials" in boto3? Give the credential provider chain something to find: run aws configure to write ~/.aws/credentials, set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the process's environment, or attach an IAM role on EC2/ECS/Lambda. Then verify with aws sts get-caller-identity.

Is "Unable to locate credentials" the same as AccessDeniedException? No. NoCredentialsError is raised locally before the request is sent, because no credential provider returned anything. AccessDeniedException comes from AWS after authentication, when a valid identity lacks IAM permission for the action.

Reproduce it

Call DynamoDB with no credentials resolvable anywhere in the chain — no environment variables, no shared credentials file, no profile, no instance role:

import boto3
boto3.client('dynamodb', region_name='us-east-1').list_tables()

Real output:

NoCredentialsError: Unable to locate credentials

The message is famously terse: it names none of the places boto3 looked. That is the whole difficulty of this error, and why working the chain in order — environment, then shared file, then profile, then role — beats guessing.

The security token included in the request is invalid — credentials were found but AWS rejected them.
AccessDeniedException — valid identity, but no IAM permission for the action.
Missing region in config
Learn: Running DynamoDB Local — dummy credentials against a local endpoint.

References

Last verified 2026-07-13 against the official AWS documentation linked above.

Reproduced 2026-07-26 against boto3 1.43.56 / botocore 1.43.56 — the output above is verbatim.