{"record":{"id":"21faee8c0bcfa298","repo":"kubernetes/kops","slug":"failed-to-load-aws-config-w-21faee","errorCode":null,"errorMessage":"failed to load aws config: %w","messagePattern":"failed to load aws config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":79,"sourceCode":"\taccountId string\n\tpartition string\n\topt       AWSVerifierOptions\n\n\tec2    *ec2.Client\n\tclient http.Client\n\n\tstsRequestValidator *stsRequestValidator\n}\n\nvar _ bootstrap.Verifier = (*awsVerifier)(nil)\n\nfunc NewAWSVerifier(ctx context.Context, opt *AWSVerifierOptions) (bootstrap.Verifier, error) {\n\tconfig, err := awsconfig.LoadDefaultConfig(\n\t\tctx,\n\t\tawsconfig.WithRegion(opt.Region),\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load aws config: %w\", err)\n\t}\n\n\tstsClient := sts.NewFromConfig(config)\n\tidentity, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tpartition := strings.Split(aws.ToString(identity.Arn), \":\")[1]\n\n\tec2Client := ec2.NewFromConfig(config)\n\n\tstsRequestValidator, err := buildSTSRequestValidator(ctx, stsClient)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &awsVerifier{","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L61-L97","documentation":"NewAWSVerifier wraps awsconfig.LoadDefaultConfig failure when constructing the kops node verifier on the server. It fires when no usable AWS credential chain / region can be resolved (missing env vars, no instance profile, invalid shared config) — the verifier cannot talk to AWS at all and cannot authenticate nodes.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:79 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide valid AWS credentials (env, profile, or role)","Set a valid region","Check instance metadata access if on EC2"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}