VictoriaMetrics/VictoriaMetrics · error

cannot obtain instance role credentials: %w

Error message

cannot obtain instance role credentials: %w

What it means

Fires in getAPICredentials default branch when getInstanceRoleCredentials fails — no access keys, web token, container URI, or profile matched, so the code falls back to EC2 instance metadata (IMDS) and that call errored. Usually means IMDS is unreachable, throttled, or the instance has no attached IAM role.

Source

Thrown at lib/awsapi/config.go:270

			}
			credProfile = sourceProfile
		}
		if roleARN == "" {
			roleARN = profileRoleARN
		}
		ac, err := readSharedCredentials(credProfile)
		if err != nil {
			return nil, fmt.Errorf("cannot read shared credentials for profile %q: %w", credProfile, err)
		}
		if ac == nil {
			return nil, fmt.Errorf("missing credentials for profile %q", credProfile)
		}
		acNew = ac
	default:
		// we need instance credentials if we do not have access keys
		ac, err := getInstanceRoleCredentials(cfg.client)
		if err != nil {
			return nil, fmt.Errorf("cannot obtain instance role credentials: %w", err)
		}
		acNew = ac
	}
	// read credentials from sts api, if role_arn is defined
	if len(roleARN) > 0 {
		ac, err := cfg.getRoleARNCredentials(acNew, roleARN)
		if err != nil {
			return nil, fmt.Errorf("cannot get credentials for role_arn %q: %w", roleARN, err)
		}
		acNew = ac
	}
	if len(acNew.AccessKeyID) == 0 {
		return nil, fmt.Errorf("missing AWS access_key; it may be set via env var AWS_ACCESS_KEY_ID or use instance iam role")
	}
	if len(acNew.SecretAccessKey) == 0 {
		return nil, fmt.Errorf("missing AWS secret_key; it may be set via env var AWS_SECRET_ACCESS_KEY or use instance iam role")
	}
	return acNew, nil

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Attach an IAM instance profile role to the EC2 instance
2. Verify IMDS is reachable (check IMDSv2 token TTL/hop limits, firewall rules blocking 169.254.169.254)
3. Alternatively configure explicit access keys or a profile instead of relying on the instance role

When it happens

Trigger: Thrown at lib/awsapi/config.go:270 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/fb42ebb44f0e09e3. Report an issue: GitHub.