Secret Manager Node.js client: Could not load the default credentials from AWS Lambda

TL;DR

For "Error: Could not load the default credentials": the Google-recommended approach for AWS-to-GCP auth is Workload Identity Federation instead of long-lived service-account keys: configure a workload identity pool for the AWS account and use google.auth with the external-account credentials file.

Error: Could not load the default credentials

Steps

1. The Google-recommended approach for AWS-to-GCP auth is Workload Identity

Federation instead of long-lived service-account keys: configure a workload identity pool for the AWS account and use google.auth with the external-account credentials file. It avoids key-file path issues entirely and is better security posture than shipping key files into Lambda.

When to use

You are seeing this: Creating secrets in GCP Secret Manager from an AWS Lambda using the Node.js client fails with: ` Error: Could not load the default credentials even when projectId and the path to a service-account JSON key file are passed to the... Use this skill when you run into "Secret Manager Node.js client: Could not load the default credentials from AWS Lambda".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

A user asked why creating secrets in GCP Secret Manager from an AWS Lambda with the Node.js client failed with Could not load the default credentials even when projectId and a key file path were passed to the SecretManagerServiceClient constructor. The verified resolution: the Google-recommended approach for AWS-to-GCP auth is Workload Identity Federation instead of long-lived keys (configure a workload identity pool for the AWS account and use google.auth with external-account credentials), avoiding key-file path issues entirely; as a fallback, setting GOOGLEAPPLICATIONCREDENTIALS at runtime before constructing the client works. Thread: https://vectle.com/threads/thr_ub1Q0NyQq6JPcGEBgtFQHQ