JuliusBrussee/caveman · error

awssig: incomplete AWS credentials

Error message

awssig: incomplete AWS credentials

What it means

Sign found incomplete AWS credentials: the access key ID or secret (or the expected session token pairing) is missing from the resolved credential set. The signer fails before signing so requests are never sent with absent or half-present credentials; the error deliberately never echoes the secret.

Source

Thrown at shared/platform/awssig/awssig.go:70

}

// Sign computes the SigV4 signature for req against the given payload and sets
// the Authorization, X-Amz-Date, X-Amz-Content-Sha256 (and, when present,
// X-Amz-Security-Token) headers on req. The Host header is derived from req.URL.
//
// payloadHash is the lowercase hex SHA-256 of the request body; pass
// HashPayload(body) for the common case, or UnsignedPayload() for streaming
// bodies that must not be buffered. now fixes the signing instant (use
// time.Now().UTC()); it is a parameter so tests are deterministic.
//
// Sign returns an error only for malformed inputs (no region/service, missing
// credentials, unparseable URL). It never returns the secret in the error.
func (s Signer) Sign(req *http.Request, creds Credentials, payloadHash string, now time.Time) error {
	if s.Region == "" || s.Service == "" {
		return fmt.Errorf("awssig: signer requires region and service")
	}
	if !creds.Valid() {
		return fmt.Errorf("awssig: incomplete AWS credentials")
	}
	if req.URL == nil {
		return fmt.Errorf("awssig: request has no URL")
	}
	now = now.UTC()
	amzDate := now.Format("20060102T150405Z")
	dateStamp := now.Format("20060102")

	host := req.URL.Host
	if req.Host != "" {
		host = req.Host
	}
	req.Header.Set("Host", host)
	req.Header.Set("X-Amz-Date", amzDate)
	req.Header.Set("X-Amz-Content-Sha256", payloadHash)
	if creds.SessionToken != "" {
		req.Header.Set("X-Amz-Security-Token", creds.SessionToken)
	}

View on GitHub (pinned to 766dce6b13)

Solutions

1. Provide a complete credential set: access key ID, secret, and session token if using temporary credentials
2. Check that the credential chain/environment actually resolved all required fields

When it happens

Trigger: Thrown at shared/platform/awssig/awssig.go:70 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/a8fa8c222c4f2f1c. Report an issue: GitHub.