{"record":{"id":"4264e77719b14ef6","repo":"getsops/sops","slug":"unable-to-load-sdk-config-w","errorCode":null,"errorMessage":"unable to load SDK config: %w","messagePattern":"unable to load SDK config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"publish/s3.go","lineNumber":34,"sourceCode":"\ts3Bucket string\n\ts3Prefix string\n}\n\n// NewS3Destination is the constructor for an S3 Destination\nfunc NewS3Destination(s3Bucket, s3Prefix string) *S3Destination {\n\treturn &S3Destination{s3Bucket, s3Prefix}\n}\n\n// Path returns the S3 path of a file in an S3 Destination (bucket)\nfunc (s3d *S3Destination) Path(fileName string) string {\n\treturn fmt.Sprintf(\"s3://%s/%s%s\", s3d.s3Bucket, s3d.s3Prefix, fileName)\n}\n\n// Upload uploads contents to a file in an S3 Destination (bucket)\nfunc (s3d *S3Destination) Upload(fileContents []byte, fileName string) error {\n\tcfg, err := config.LoadDefaultConfig(context.TODO())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to load SDK config: %w\", err)\n\t}\n\tsvc := s3.NewFromConfig(cfg)\n\tinput := &s3.PutObjectInput{\n\t\tBody:   manager.ReadSeekCloser(bytes.NewReader(fileContents)),\n\t\tBucket: aws.String(s3d.s3Bucket),\n\t\tKey:    aws.String(s3d.s3Prefix + fileName),\n\t}\n\tif _, err = svc.PutObject(context.TODO(), input); err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\n// Returns NotImplementedError\nfunc (s3d *S3Destination) UploadUnencrypted(data map[string]interface{}, fileName string) error {\n\treturn &NotImplementedError{\"S3 does not support uploading the unencrypted file contents.\"}\n}\n","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/publish/s3.go#L16-L52","documentation":"S3Destination.Upload calls the AWS SDK v2 config.LoadDefaultConfig to build credentials/region settings, and this error wraps any failure of that load. The library throws it because without a valid SDK config it cannot construct the S3 client.","triggerScenarios":"Calling S3Destination.Upload(fileContents, fileName) when LoadDefaultConfig fails — e.g. malformed AWS_* environment variables, unreadable shared credentials/config files, or an invalid profile name.","commonSituations":"Missing AWS credentials in CI containers, typo'd AWS_PROFILE, malformed ~/.aws/config, stale or invalid ~/.aws/credentials, or a bad AWS_SDK_LOAD_CONFIG setup.","solutions":["Ensure AWS credentials are present: AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (or attached IAM role) are set and readable.","Check ~/.aws/config and ~/.aws/credentials parse correctly and the referenced profile exists.","Set AWS_REGION or a default region in the config file.","Inspect the wrapped %w cause to pinpoint which source failed."],"exampleFix":"// before (env)\nAWS_PROFILE=no-such-profile app publish s3 ...\n// after\nexport AWS_PROFILE=default\nexport AWS_REGION=us-east-1","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" && os.Getenv(\"AWS_PROFILE\") == \"\" {\n    if _, err := os.Stat(filepath.Join(homedir, \".aws\", \"credentials\")); err != nil {\n        return fmt.Errorf(\"no AWS credentials configured\")\n    }\n}","typeGuard":null,"tryCatchPattern":"err := dest.Upload(data, name)\nif err != nil && strings.Contains(err.Error(), \"unable to load SDK config\") {\n    return fmt.Errorf(\"check AWS env/credentials: %w\", err)\n}","preventionTips":["Set AWS_REGION alongside credentials","Validate AWS env in CI before jobs run","Use instance profiles/task roles instead of static files where possible","Run `aws sts get-caller-identity` as a preflight check"],"tags":["aws","s3","configuration","go"],"backgroundTag":"aws-sdk-config-load-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}