diff --git a/packages/providers/upload-aws-s3/src/index.ts b/packages/providers/upload-aws-s3/src/index.ts
index 7d1366e254..dac9ea3a29 100644
--- a/packages/providers/upload-aws-s3/src/index.ts
+++ b/packages/providers/upload-aws-s3/src/index.ts
@@ -80,7 +80,7 @@ const getConfig = ({ baseUrl, rootPath, s3Options, ...legacyS3Options }: InitOpt
   const config = {
     ...s3Options,
     ...legacyS3Options,
-    ...[credentials ? { credentials } : {}],
+    ...(credentials ? { credentials } : {}),
   };
 
   config.params.ACL = getOr(ObjectCannedACL.public_read, ['params', 'ACL'], config);
diff --git a/packages/providers/upload-aws-s3/src/utils.ts b/packages/providers/upload-aws-s3/src/utils.ts
index 0fcf30096e..656971db8a 100644
--- a/packages/providers/upload-aws-s3/src/utils.ts
+++ b/packages/providers/upload-aws-s3/src/utils.ts
@@ -89,7 +89,7 @@ function getBucketFromAwsUrl(fileUrl: string): BucketInfo {
 }
 
 // TODO Remove this in V5 since we will only support the new config structure
-export const extractCredentials = (options: InitOptions): AwsCredentialIdentity => {
+export const extractCredentials = (options: InitOptions): AwsCredentialIdentity | null => {
   // legacy
   if (options.accessKeyId && options.secretAccessKey) {
     return {
@@ -114,5 +114,5 @@ export const extractCredentials = (options: InitOptions): AwsCredentialIdentity
       secretAccessKey: options.s3Options.credentials.secretAccessKey,
     };
   }
-  return {};
+  return null;
 };