{"record":{"id":"2174fc3d9adedfcb","repo":"netbirdio/netbird","slug":"failed-to-presign-url","errorCode":null,"errorMessage":"failed to presign URL","messagePattern":"failed to presign URL","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"upload-server/server/s3.go","lineNumber":63,"sourceCode":"}\n\nfunc (s *sThree) handlerGetUploadURL(w http.ResponseWriter, r *http.Request) {\n\tif !isValidRequest(w, r) {\n\t\treturn\n\t}\n\n\tobjectKey := getObjectKey(w, r)\n\tif objectKey == \"\" {\n\t\treturn\n\t}\n\n\treq, err := s.presignClient.PresignPutObject(s.ctx, &s3.PutObjectInput{\n\t\tBucket: aws.String(s.bucket),\n\t\tKey:    aws.String(objectKey),\n\t}, s3.WithPresignExpires(15*time.Minute))\n\n\tif err != nil {\n\t\thttp.Error(w, \"failed to presign URL\", http.StatusInternalServerError)\n\t\tlog.Errorf(\"Presign error: %v\", err)\n\t\treturn\n\t}\n\n\trespondGetRequest(w, req.URL, objectKey)\n}\n","sourceCodeStart":45,"sourceCodeEnd":70,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/upload-server/server/s3.go#L45-L70","documentation":"HTTP 500 from the S3-backed handler when presignClient.PresignPutObject fails. Presigning is local SigV4 signing, but the AWS SDK for Go v2 still needs resolvable credentials and a region (AWS_REGION is required at startup, BUCKET selects the S3 backend); the SDK error is logged server-side as 'Presign error'.","triggerScenarios":"No credentials reachable by config.LoadDefaultConfig (no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, no profile, no IAM role); EC2/ECS/K8s pod where IMDS or IRSA is unreachable so credential resolution fails at presign time; expired STS session tokens; malformed shared config file.","commonSituations":"Local development without 'aws configure'; Kubernetes pod missing the service-account role annotation or env; AssumeRole sessions expiring under a long-running server; credentials working yesterday but the token rotated.","solutions":["Give the server resolvable credentials: export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (plus AWS_SESSION_TOKEN for STS) or attach an IAM role","Verify with 'aws sts get-caller-identity' run in the same environment as the server","Confirm BUCKET and AWS_REGION are set for the process (missing AWS_REGION aborts startup earlier with a Fatal log)","For IMDS timeouts, set AWS_EC2_METADATA_DISABLED=true together with explicit keys"],"exampleFix":"# before: no credentials reachable -> every GET /upload-url returns 500\ndocker run -e BUCKET=mybucket -e AWS_REGION=eu-west-1 nb/upload-server\n\n# after: credentials passed through\nexport AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...\ndocker run -e BUCKET=mybucket -e AWS_REGION=eu-west-1 \\\n  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY nb/upload-server","handlingStrategy":"validation","validationCode":"// smoke test at server startup: fail fast if presigning cannot work\ncfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(region))\nif err != nil {\n\tlog.Fatalf(\"aws config: %v\", err)\n}\npc := s3.NewPresignClient(s3.NewFromConfig(cfg))\nif _, err := pc.PresignPutObject(ctx, &s3.PutObjectInput{\n\tBucket: aws.String(bucket), Key: aws.String(\"healthcheck\"),\n}, s3.WithPresignExpires(time.Minute)); err != nil {\n\tlog.Fatalf(\"presign unavailable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"A 500 'failed to presign URL' usually repeats until credentials are fixed: check the server log ('Presign error'), run aws sts get-caller-identity in the server environment, then retry the GET /upload-url.","preventionTips":["Validate credentials with aws sts get-caller-identity in the same env as the server","Refresh STS tokens before expiry or use long-lived role credentials for long-running servers","Alert on 'Presign error' log lines; they indicate credential drift, not client bugs"],"tags":["aws","s3","presign","credentials","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}