{"record":{"id":"0612dc42d53f94af","repo":"openai/codex","slug":"aws-service-name-must-not-be-empty","errorCode":null,"errorMessage":"AWS service name must not be empty","messagePattern":"AWS service name must not be empty","errorType":"exception","errorClass":"AwsAuthError","httpStatus":null,"severity":"error","filePath":"codex-rs/aws-auth/src/lib.rs","lineNumber":45,"sourceCode":"#[derive(Debug, Clone, PartialEq, Eq)]\npub struct AwsRequestToSign {\n    pub method: Method,\n    pub url: String,\n    pub headers: HeaderMap,\n    pub body: Bytes,\n}\n\n/// Signed request parts returned to the caller.\n#[derive(Debug, Clone, PartialEq, Eq)]\npub struct AwsSignedRequest {\n    pub url: String,\n    pub headers: HeaderMap,\n}\n\n/// Errors returned by credential loading or SigV4 signing.\n#[derive(Debug, Error)]\npub enum AwsAuthError {\n    #[error(\"AWS service name must not be empty\")]\n    EmptyService,\n    #[error(\"AWS profile must be configured\")]\n    MissingProfile,\n    #[error(\"AWS SDK config did not resolve a credentials provider\")]\n    MissingCredentialsProvider,\n    #[error(\"AWS SDK config did not resolve a region\")]\n    MissingRegion,\n    #[error(\"failed to load AWS profiles: {0}\")]\n    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),\n    #[error(\"failed to load AWS credentials: {0}\")]\n    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),\n    #[error(\"request URL is not a valid URI: {0}\")]\n    InvalidUri(#[source] http::uri::InvalidUri),\n    #[error(\"failed to construct HTTP request for signing: {0}\")]\n    BuildHttpRequest(#[source] http::Error),\n    #[error(\"request contains a non-UTF8 header value: {0}\")]\n    InvalidHeaderValue(#[source] http::header::ToStrError),\n    #[error(\"failed to build signable request: {0}\")]","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/aws-auth/src/lib.rs#L27-L63","documentation":"AwsAuthContext::load (and load_profile, which delegates to it) calls load_sdk_config, which rejects the call up front when AwsAuthConfig.service is empty after trimming. The service name (e.g. 's3', 'execute-api', 'bedrock') is required input for SigV4 signing, so an empty one is a programming or configuration error, not an environment problem. AwsAuthError::is_retryable() classifies it as non-retryable.","triggerScenarios":"Constructing AwsAuthConfig with service: String::new() or a whitespace-only service string and calling AwsAuthContext::load or load_profile; service populated from an optional setting or env var that defaulted to empty.","commonSituations":"Config plumbing where the service string comes from an optional field nobody set; new integration wiring where the service argument was forgotten.","solutions":["Set AwsAuthConfig.service to the target AWS service signing name ('s3', 'execute-api', 'bedrock', ...)","If service comes from config or env, validate it is non-empty after trimming before constructing AwsAuthConfig","Fail fast at config parse time with a message naming the missing field"],"exampleFix":"// before\nlet ctx = AwsAuthContext::load(AwsAuthConfig {\n    profile: None, region: Some(\"us-east-1\".into()), service: String::new(),\n}).await?; // EmptyService\n\n// after\nlet ctx = AwsAuthContext::load(AwsAuthConfig {\n    profile: None, region: Some(\"us-east-1\".into()), service: \"s3\".into(),\n}).await?;","handlingStrategy":"validation","validationCode":"if config.service.trim().is_empty() {\n    return Err(\"aws service name is required for signing\");\n}\nlet ctx = AwsAuthContext::load(config).await?;","typeGuard":"fn is_empty_service(e: &AwsAuthError) -> bool {\n    matches!(e, AwsAuthError::EmptyService)\n}","tryCatchPattern":"match AwsAuthContext::load(config).await {\n    Err(e @ AwsAuthError::EmptyService) => return Err(config_error(e)), // not retryable\n    Err(AwsAuthError::Credentials(c)) => /* provider failed: check env */ (),\n    other => other?,\n}","preventionTips":["Make the service field non-optional in your own config types","Validate service/region/profile once at config load, not per request"],"tags":["rust","aws","sigv4","configuration"],"backgroundTag":"missing-required-config-field","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}