diff --git a/botocore/utils.py b/botocore/utils.py
index 9553e0c82a..d63b35e6e3 100644
--- a/botocore/utils.py
+++ b/botocore/utils.py
@@ -3630,7 +3630,14 @@ def get_token_from_environment(signing_name, environ=None):
     if environ is None:
         environ = os.environ
     env_var = _get_bearer_env_var_name(signing_name)
-    return environ.get(env_var)
+    token = environ.get(env_var)
+    if token == '':
+        logger.warning(
+            "%s is set to an empty value; requests using bearer "
+            "authentication may fail",
+            env_var,
+        )
+    return token
 
 
 def _get_bearer_env_var_name(signing_name):
diff --git a/tests/unit/test_utils.py b/tests/unit/test_utils.py
index 702fb16515..47bf929d2e 100644
--- a/tests/unit/test_utils.py
+++ b/tests/unit/test_utils.py
@@ -13,6 +13,7 @@
 import copy
 import datetime
 import io
+import logging
 import operator
 import os
 import shutil
@@ -3726,6 +3727,14 @@ def test_get_token_from_environment_returns_token(
     assert get_token_from_environment(signing_name) == token
 
 
+def test_get_token_from_environment_warns_for_empty_token(monkeypatch, caplog):
+    monkeypatch.setenv("AWS_BEARER_TOKEN_MY_SERVICE", "")
+    caplog.set_level(logging.WARNING, logger="botocore.utils")
+
+    assert get_token_from_environment("my-service") == ""
+    assert "AWS_BEARER_TOKEN_MY_SERVICE is set to an empty value" in caplog.text
+
+
 @pytest.mark.parametrize(
     "signing_name, env_var",
     [