{"record":{"id":"0638d8be432f86aa","repo":"kubernetes/kops","slug":"failed-to-load-default-aws-config-for-sts-client","errorCode":null,"errorMessage":"failed to load default aws config for STS client: %w","messagePattern":"failed to load default aws config for STS client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dnsprovider/pkg/dnsprovider/providers/aws/route53/route53.go","lineNumber":92,"sourceCode":"\tawsOptions := []func(*awsconfig.LoadOptions) error{\n\t\tawsconfig.WithClientLogMode(aws.LogRetries),\n\t\tawslog.WithAWSLogger(),\n\t\tawsconfig.WithRetryer(func() aws.Retryer {\n\t\t\treturn retry.AddWithMaxAttempts(retry.NewStandard(), 5)\n\t\t}),\n\t}\n\n\tif imdsClient != nil {\n\t\tstsCfg, err := awsconfig.LoadDefaultConfig(ctx,\n\t\t\tawsconfig.WithClientLogMode(aws.LogRetries),\n\t\t\tawslog.WithAWSLogger(),\n\t\t\tawsconfig.WithRetryer(func() aws.Retryer {\n\t\t\t\treturn retry.AddWithMaxAttempts(retry.NewStandard(), 5)\n\t\t\t}),\n\t\t\tawsconfig.WithRegion(region),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load default aws config for STS client: %w\", err)\n\t\t}\n\n\t\tawsOptions = append(\n\t\t\tawsOptions,\n\t\t\tawsconfig.WithEC2IMDSRegion(func(o *awsconfig.UseEC2IMDSRegion) {\n\t\t\t\to.Client = imdsClient\n\t\t\t}),\n\t\t\tawsconfig.WithAssumeRoleCredentialOptions(func(aro *stscreds.AssumeRoleOptions) {\n\t\t\t\t// Ensure the STS client has a region configured, if discovered by IMDS\n\t\t\t\taro.Client = sts.NewFromConfig(stsCfg)\n\t\t\t}),\n\t\t)\n\t}\n\n\tcfg, err := awsconfig.LoadDefaultConfig(ctx, awsOptions...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load default aws config: %w\", err)\n\t}","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/dnsprovider/pkg/dnsprovider/providers/aws/route53/route53.go#L74-L110","documentation":"Wraps a failure of awsconfig.LoadDefaultConfig while the Route53 DNS provider builds a dedicated STS client config (when an IMDS client is supplied). AWS SDK config resolution — credentials, region, or IMDS interaction — failed before any DNS API call was made.","triggerScenarios":"newRoute53 running on an EC2 instance (region discovered via IMDS) whose second LoadDefaultConfig — with WithRegion(region) and the standard retryer — fails due to invalid profile/SSO/credential-file configuration.","commonSituations":"Expired SSO session in the profile; invalid assume-role source profile; shared config file changed between the two loads; region value from IMDS combined with a profile that has incompatible settings.","solutions":["Read the wrapped error and fix the offending shared config/credential profile (e.g. re-run `aws sso login`).","Verify the referenced source_profile / role_arn entries exist and are valid.","Set explicit valid AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env credentials as a fallback.","Re-test with `aws sts get-caller-identity --profile <name>`."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// validate the profile resolves before calling the library\nout, err := exec.Command(\"aws\", \"sts\", \"get-caller-identity\", \"--profile\", os.Getenv(\"AWS_PROFILE\")).Output()\nif err != nil {\n    return fmt.Errorf(\"AWS profile invalid or SSO expired: %w\", err)\n}\n_ = out","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"failed to load default aws config for STS client\") {\n    // SSO/assume-role profiles are the usual culprit; re-authenticate\n    return fmt.Errorf(\"run 'aws sso login' or fix profile: %w\", err)\n}","preventionTips":["Refresh SSO sessions before long-running jobs.","Ensure source_profile entries referenced by assume-role profiles exist.","Set explicit credentials env vars in CI instead of relying on profiles."],"tags":["aws","route53","sts","config"],"backgroundTag":"aws-config-load-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}