{"record":{"id":"56b98a4ddff2b41c","repo":"kubernetes/kops","slug":"error-querying-for-valid-azs-in-q-verify-your-a","errorCode":null,"errorMessage":"error querying for valid AZs in %q - verify your AWS credentials.  Error: %v","messagePattern":"error querying for valid AZs in %q - verify your AWS credentials\\.  Error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":1799,"sourceCode":"\t\treturn WellKnownAccountFlatcar\n\tcase \"redhat\", \"redhat.com\":\n\t\treturn WellKnownAccountRedhat\n\tcase \"ubuntu\":\n\t\treturn WellKnownAccountUbuntu\n\tcase \"rocky\", \"rockylinux\":\n\t\treturn WellKnownAccountRockyLinux\n\t}\n\treturn owner\n}\n\nfunc (c *awsCloudImplementation) DescribeAvailabilityZones() ([]ec2types.AvailabilityZone, error) {\n\tklog.V(2).Infof(\"Querying EC2 for all valid zones in region %q\", c.region)\n\tctx := context.TODO()\n\n\trequest := &ec2.DescribeAvailabilityZonesInput{}\n\tresponse, err := c.EC2().DescribeAvailabilityZones(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error querying for valid AZs in %q - verify your AWS credentials.  Error: %v\", c.region, err)\n\t}\n\n\treturn response.AvailabilityZones, nil\n}\n\n// ValidateZones checks that every zone in the sliced passed is recognized\nfunc ValidateZones(zones []string, cloud AWSCloud) error {\n\tazs, err := cloud.DescribeAvailabilityZones()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tzoneMap := make(map[string]ec2types.AvailabilityZone)\n\tfor _, z := range azs {\n\t\tname := aws.ToString(z.ZoneName)\n\t\tzoneMap[name] = z\n\t}\n","sourceCodeStart":1781,"sourceCodeEnd":1817,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L1781-L1817","documentation":"Returned by DescribeAvailabilityZones (aws_cloud.go:1799) when ec2.DescribeAvailabilityZones fails; the message explicitly hints to verify AWS credentials because the most common cause is authentication. The region is interpolated for context.","triggerScenarios":"c.EC2().DescribeAvailabilityZones errors due to invalid/expired credentials, no ec2:DescribeAvailabilityZones permission, network egress blocked, wrong region name, or STS token expiry on assumed roles.","commonSituations":"First EC2 call during `kops create cluster` with unset AWS_PROFILE; expired SSO/STS session; corporate proxy blocking EC2 endpoints; IAM policy missing EC2 read permissions; typo'd region like `us-east-1a` used as a region.","solutions":["Run `aws ec2 describe-availability-zones --region <region>` with the same credentials to see the raw error","Refresh credentials: `aws sso login`, re-export keys, or fix the instance/profile role","Check the region value is a valid region ID, not an AZ name","Grant ec2:DescribeAvailabilityZones in the caller's IAM policy and verify network/proxy egress to ec2.<region>.amazonaws.com"],"exampleFix":"// before\nexport AWS_REGION=us-east-1a   # AZ, not region; expired keys\n// after\naws sso login && export AWS_REGION=us-east-1","handlingStrategy":"try-catch","validationCode":"// Pre-flight credential/region check before kops runs\nsessCfg, err := config.LoadDefaultConfig(ctx)\nif err != nil { return fmt.Errorf(\"no AWS config: %w\", err) }\n_, err = ec2.NewFromConfig(sessCfg).DescribeAvailabilityZones(ctx, &ec2.DescribeAvailabilityZonesInput{})\nif err != nil { return fmt.Errorf(\"AWS credentials/region invalid: %w\", err) }","typeGuard":null,"tryCatchPattern":"zones, err := cloud.DescribeAvailabilityZones()\nif err != nil {\n\tif strings.Contains(err.Error(), \"AuthFailure\") || strings.Contains(err.Error(), \"ExpiredToken\") {\n\t\t// prompt credential refresh (aws sso login / new keys) and retry\n\t}\n\treturn err\n}","preventionTips":["Run `aws sts get-caller-identity` before long kops operations to catch expired sessions early","Set AWS_REGION explicitly; never pass an AZ name as a region","Verify corporate proxy/firewall allows egress to ec2.<region>.amazonaws.com","Include EC2 Describe* read permissions in the automation role"],"tags":["aws","ec2","credentials","availability-zones"],"backgroundTag":"invalid-aws-credentials","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}