{"record":{"id":"3e68c8e6c8752735","repo":"kubernetes/kops","slug":"failed-to-get-region-from-ec2-metadata-w","errorCode":null,"errorMessage":"failed to get region from ec2 metadata: %w","messagePattern":"failed to get region from ec2 metadata: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":66,"sourceCode":"\tregion string\n\n\t// credentialsProvider returns our AWS credentials, for sigining V1 requests\n\tcredentialsProvider aws.CredentialsProvider\n}\n\nvar _ bootstrap.Authenticator = (*awsAuthenticator)(nil)\n\n// RegionFromMetadata returns the current region from the aws metdata\nfunc RegionFromMetadata(ctx context.Context) (string, error) {\n\tcfg, err := awsconfig.LoadDefaultConfig(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to load default aws config: %w\", err)\n\t}\n\tmetadata := imds.NewFromConfig(cfg)\n\n\tresp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get region from ec2 metadata: %w\", err)\n\t}\n\treturn resp.Region, nil\n}\n\nfunc NewAWSAuthenticator(ctx context.Context, region string) (bootstrap.Authenticator, error) {\n\tconfig, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load aws config: %w\", err)\n\t}\n\treturn &awsAuthenticator{\n\t\tcredentialsProvider: config.Credentials,\n\t\tregion:              region,\n\t\tsts:                 sts.NewFromConfig(config),\n\t}, nil\n}\n\n// awsV1Token is the format of the V1 request, it matches http.Header\ntype awsV1Token map[string][]string","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L48-L84","documentation":"After loading the default config, RegionFromMetadata queries EC2 Instance Metadata Service (IMDS) GetRegion to discover the current region. If the IMDS request fails (unreachable endpoint, timeout, HTTP error, or empty/failed response), the SDK error is wrapped with this message. It means the code is not running where IMDS is available or IMDS is misconfigured/blocked.","triggerScenarios":"Calling RegionFromMetadata on a machine without EC2 IMDS (laptop, on-prem, non-AWS cloud), with IMDS disabled or set to require tokens while blocked, with a hop limit too low for container/overlay networking, or with a proxy/firewall dropping 169.254.169.254.","commonSituations":"Running kops AWS bootstrap commands inside a Docker/Kubernetes pod where IMDSv2 hop limit is 1; IMDS disabled on the instance for hardening; running the tool locally on a developer machine; iptables or security software blocking link-local metadata traffic.","solutions":["Run the code on an EC2 instance with IMDS enabled; if running in a container on ECS/EC2, raise the IMDSv2 hop limit to 2 (aws ec2 modify-instance-metadata-options --http-put-response-hop-limit 2).","If IMDS is intentionally unavailable, avoid RegionFromMetadata and supply the region explicitly (e.g. NewAWSAuthenticator with a known region).","Check that 169.254.169.254 is reachable: curl -s http://169.254.169.254/latest/meta-data/placement/region; fix proxy/firewall rules that block link-local traffic."],"exampleFix":"// before: region inferred from IMDS (fails off-EC2)\nregion, err := awsbootstrap.RegionFromMetadata(ctx)\n// after: pass region explicitly\nregion := \"us-east-1\"\nauth, err := awsbootstrap.NewAWSAuthenticator(ctx, region)","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"region, err := awsbootstrap.RegionFromMetadata(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to get region from ec2 metadata\") {\n        // not on EC2 or IMDS blocked - use configured region\n        region = cfgFlag.Region\n    }\n    return fmt.Errorf(\"resolving region: %w\", err)\n}","preventionTips":["Only call RegionFromMetadata on EC2 instances with IMDS enabled.","In containers, set IMDSv2 hop limit >= 2 (aws ec2 modify-instance-metadata-options --http-put-response-hop-limit 2).","Never proxy or firewall link-local traffic to 169.254.169.254.","Always offer an explicit --region fallback in tooling instead of relying solely on IMDS."],"tags":["go","aws","ec2","imds","network","bootstrap"],"backgroundTag":"imds-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}