Tencent/WeKnora · error

failed to generate presigned URL: %w

Error message

failed to generate presigned URL: %w

What it means

GetFileURL wraps errors from the S3 presign client's PresignGetObject call with a 24-hour expiry. Presigning is done locally from credentials, so failures usually mean missing or invalid credentials, an invalid region/endpoint, or an expiry configuration problem — not object existence.

Source

Thrown at internal/application/service/file/s3.go:365

}

// GetFileURL returns a presigned download URL for the file
func (s *s3FileService) GetFileURL(ctx context.Context, filePath string) (string, error) {
	objectName, err := s.parseS3FilePath(filePath)
	if err != nil {
		return "", err
	}

	// Create presign client
	presignClient := s3.NewPresignClient(s.client)

	// Generate presigned URL
	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
		Bucket: aws.String(s.bucketName),
		Key:    aws.String(objectName),
	}, s3.WithPresignExpires(24*time.Hour))
	if err != nil {
		return "", fmt.Errorf("failed to generate presigned URL: %w", err)
	}

	return presignedReq.URL, nil
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Verify AWS credentials are present and valid (aws sts get-caller-identity with the same env/config)
2. Confirm region and endpoint configuration for the S3 client used to build the presigner
3. If using a custom endpoint, ensure it has a valid scheme and is reachable
4. Unwrap the %w chain to see the credential/signer error and fix accordingly

Example fix

// before
url, err := svc.GetFileURL(ctx, path)
// after
url, err := svc.GetFileURL(ctx, path)
if err != nil {
    log.Printf("presign failed (check credentials/region): %v", err)
    return err
}

// ensure credentials resolvable before presign
if _, err := cfgProvider.Retrieve(ctx); err != nil {
    return fmt.Errorf("no valid AWS credentials: %w", err)
}

url, err := svc.GetFileURL(ctx, path)
if err != nil {
    // fallback: stream the file through the app instead
    return streamViaGetFile(ctx, path)
}

When it happens

Trigger: PresignGetObject failing because credentials are not loadable/valid, the region or endpoint is misconfigured, or the presign client could not be constructed (custom endpoint without proper scheme).

Common situations: Static credentials empty at startup; region unset in config; custom endpoint proxy lacking https scheme; credential provider (IRSA/instance role) unavailable at presign time.

Related errors

• failed to load AWS config: %w
• S3 access key and secret key must be provided together
• failed to get file from S3: %w
• failed to delete file: %w
• s3 copy rejected source %q: %w

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/371e004f7203ba4e. Report an issue: GitHub.