diff --git a/changelog/4333.added.md b/changelog/4333.added.md
new file mode 100644
index 000000000..ea1f1b17b
--- /dev/null
+++ b/changelog/4333.added.md
@@ -0,0 +1 @@
+- AWS Transcribe STT, Polly TTS, Bedrock LLM, and the Bedrock AgentCore processor now resolve credentials via the standard boto3 provider chain (EC2 instance profiles, EKS pod roles / IRSA, ECS task roles, SSO, `~/.aws/credentials`) when explicit credentials and `AWS_*` environment variables are absent. Services running with IAM roles no longer need to export static credentials.
diff --git a/changelog/4333.fixed.md b/changelog/4333.fixed.md
new file mode 100644
index 000000000..a260bf499
--- /dev/null
+++ b/changelog/4333.fixed.md
@@ -0,0 +1 @@
+- Fixed AWS Polly TTS, Bedrock LLM, and the Bedrock AgentCore processor erroring out when only one of `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` was set in the environment. The half-populated kwargs are no longer forwarded to aioboto3; partial env-var configurations now fall through to the boto3 credential chain like fully-unset configurations do.