Tencent/WeKnora · error

failed to load AWS config: %w

Error message

failed to load AWS config: %w

What it means

newS3Client calls config.LoadDefaultConfig to build the aws.Config (region plus optional credential chain). This error wraps any failure from that load — usually invalid credential chain resolution or a bad region/config file — so an S3 client could not be constructed at all.

Source

Thrown at internal/application/service/file/s3.go:55

	var cfg aws.Config
	var err error

	// With no explicit AK/SK, keep the AWS default credential chain intact. This
	// supports IAM roles for EC2/ECS/EKS (IRSA), web identity, shared config, and
	// environment credentials without persisting long-lived keys in WeKnora.
	loadOptions := []func(*config.LoadOptions) error{config.WithRegion(region)}
	if accessKey != "" || secretKey != "" {
		if accessKey == "" || secretKey == "" {
			return nil, fmt.Errorf("S3 access key and secret key must be provided together")
		}
		loadOptions = append(loadOptions, config.WithCredentialsProvider(
			credentials.NewStaticCredentialsProvider(accessKey, secretKey, ""),
		))
	}
	cfg, err = config.LoadDefaultConfig(context.Background(), loadOptions...)

	if err != nil {
		return nil, fmt.Errorf("failed to load AWS config: %w", err)
	}

	// Create S3 client with custom endpoint if provided.
	// For S3-compatible services (non-AWS), use path-style addressing
	// (endpoint/bucket/key) instead of virtual-hosted style (bucket.endpoint/key).
	httpClient := utils.NewSSRFSafeHTTPClient(utils.DefaultSSRFSafeHTTPClientConfig())
	var client *s3.Client
	if endpoint != "" {
		usePathStyle := forcePathStyle || !strings.Contains(endpoint, "amazonaws.com")
		client = s3.NewFromConfig(cfg, func(o *s3.Options) {
			o.BaseEndpoint = aws.String(endpoint)
			o.UsePathStyle = usePathStyle
			if !strings.Contains(endpoint, "amazonaws.com") {
				// S3-compatible services commonly reject the SDK's default
				// trailing checksum negotiation. Only relax this for explicit
				// non-AWS endpoints; standard AWS S3 keeps its default behavior.
				o.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired
			}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Inspect the wrapped error for the exact config-load failure
2. Validate the shared credentials/config files parse correctly (aws CLI: aws sts get-caller-identity)
3. Confirm the region string is a valid AWS region identifier
4. If using static credentials, verify AK/SK contain no whitespace or newlines

Example fix

// before
cfg, err = config.LoadDefaultConfig(context.Background(), loadOptions...)
if err != nil { return nil, fmt.Errorf("failed to load AWS config: %w", err) }
// after
// fix the cause indicated by %w, e.g. trim credentials:
accessKey = strings.TrimSpace(accessKey)
secretKey = strings.TrimSpace(secretKey)
cfg, err = config.LoadDefaultConfig(context.Background(), loadOptions...)

if accessKey != "" && (strings.ContainsAny(accessKey, " \n\r") || strings.ContainsAny(secretKey, " \n\r")) {
    return errors.New("credentials contain whitespace/newlines")
}
if region == "" { return errors.New("region is required") }

svc, err := NewS3FileService(endpoint, ak, sk, bucket, region, prefix)
if err != nil && strings.Contains(err.Error(), "failed to load AWS config") {
    return fmt.Errorf("startup failed (check ~/.aws config and credentials): %w", err)
}

When it happens

Trigger: Calling NewS3FileService when the AWS SDK config loader fails: malformed shared credentials/config files, invalid static credentials rejected by the provider, bad AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE env, or SDK errors resolving the default chain.

Common situations: Corrupted ~/.aws/credentials after manual edits, invalid characters in AK/SK pulled from a secret store, AWS_SDK_LOAD_CONFIG issues, SDK version mismatches after upgrading aws-sdk-go-v2.

Related errors

• S3 access key and secret key must be provided together
• failed to generate presigned URL: %w
• E2BAPIKey is required for the E2B backend
• unsafe S3 endpoint: %w
• failed to get file from S3: %w

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/9fe9a2e29ddc434b. Report an issue: GitHub.