JuliusBrussee/caveman · error

awssig: signer requires region and service

Error message

awssig: signer requires region and service

What it means

Sign was called on a Signer whose Region or Service field is empty, so a SigV4 credential scope cannot be built. It is a constructor/configuration error: the signer must be instantiated with both an AWS region and service name before any request can be signed.

Source

Thrown at shared/platform/awssig/awssig.go:67

type Signer struct {
	Region  string
	Service string
}

// Sign computes the SigV4 signature for req against the given payload and sets
// the Authorization, X-Amz-Date, X-Amz-Content-Sha256 (and, when present,
// X-Amz-Security-Token) headers on req. The Host header is derived from req.URL.
//
// payloadHash is the lowercase hex SHA-256 of the request body; pass
// HashPayload(body) for the common case, or UnsignedPayload() for streaming
// bodies that must not be buffered. now fixes the signing instant (use
// time.Now().UTC()); it is a parameter so tests are deterministic.
//
// Sign returns an error only for malformed inputs (no region/service, missing
// credentials, unparseable URL). It never returns the secret in the error.
func (s Signer) Sign(req *http.Request, creds Credentials, payloadHash string, now time.Time) error {
	if s.Region == "" || s.Service == "" {
		return fmt.Errorf("awssig: signer requires region and service")
	}
	if !creds.Valid() {
		return fmt.Errorf("awssig: incomplete AWS credentials")
	}
	if req.URL == nil {
		return fmt.Errorf("awssig: request has no URL")
	}
	now = now.UTC()
	amzDate := now.Format("20060102T150405Z")
	dateStamp := now.Format("20060102")

	host := req.URL.Host
	if req.Host != "" {
		host = req.Host
	}
	req.Header.Set("Host", host)
	req.Header.Set("X-Amz-Date", amzDate)
	req.Header.Set("X-Amz-Content-Sha256", payloadHash)

View on GitHub (pinned to 766dce6b13)

Solutions

1. Set both Region (e.g. us-east-1) and Service (e.g. bedrock) on the Signer
2. Load the region from AWS configuration/endpoint ARN rather than hardcoding

When it happens

Trigger: Thrown at shared/platform/awssig/awssig.go:67 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/e49eef0b7afe46a9. Report an issue: GitHub.