{"record":{"id":"5afbac6c46ebf8ea","repo":"kubernetes/kops","slug":"got-an-error-while-querying-for-valid-regions-ver","errorCode":null,"errorMessage":"got an error while querying for valid regions (verify your AWS credentials?): %v","messagePattern":"got an error while querying for valid regions \\(verify your AWS credentials\\?\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_utils.go","lineNumber":71,"sourceCode":"\t\trequest := &ec2.DescribeRegionsInput{}\n\t\tawsRegion := os.Getenv(\"AWS_REGION\")\n\t\tif awsRegion == \"\" {\n\t\t\tawsRegion = \"us-east-1\"\n\t\t}\n\t\tcfg, err := loadAWSConfig(ctx, awsRegion)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error loading AWS config: %v\", err)\n\t\t}\n\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error starting a new AWS session: %v\", err)\n\t\t}\n\n\t\tclient := ec2.NewFromConfig(cfg)\n\n\t\tresponse, err := client.DescribeRegions(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"got an error while querying for valid regions (verify your AWS credentials?): %v\", err)\n\t\t}\n\t\tallRegions = response.Regions\n\t}\n\n\tfor _, r := range allRegions {\n\t\tname := aws.ToString(r.RegionName)\n\t\tif name == region {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\tif os.Getenv(\"SKIP_REGION_CHECK\") != \"\" {\n\t\tklog.Infof(\"AWS region does not appear to be valid, but skipping because SKIP_REGION_CHECK is set\")\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"Region is not a recognized EC2 region: %q (check you have specified valid zones?)\", region)\n}","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_utils.go#L53-L89","documentation":"ValidateRegion calls EC2 DescribeRegions to fetch the list of valid regions; if that API call fails, the error is wrapped with this message, explicitly hinting the usual cause is bad AWS credentials. This means authentication/authorization or connectivity failed when querying EC2's region list. It is distinct from config-loading failures — the config loaded, but the API call itself was rejected or could not reach EC2.","triggerScenarios":"client.DescribeRegions returns an error during ValidateRegion — e.g. InvalidClientTokenId, expired credentials, network/DNS failure reaching ec2.<region>.amazonaws.com, or STS/credential refresh failure.","commonSituations":"Wrong or placeholder AWS keys in CI, expired SSO sessions, corporate proxy blocking EC2 endpoints, clock skew invalidating SigV4 signatures, or IAM policy denying ec2:DescribeRegions.","solutions":["Run `aws ec2 describe-regions` with the same credentials to reproduce and see the underlying AWS error","Fix/refresh credentials (expired keys, stale SSO token, wrong AWS_ACCESS_KEY_ID/SECRET)","Check network/proxy reachability to the EC2 endpoint and system clock skew","Grant ec2:DescribeRegions in the IAM policy if authorization is the cause"],"exampleFix":"// before (CI)\nAWS_ACCESS_KEY_ID=AKIA...   # revoked key\n// after\n# refresh credentials, e.g.\naws sso login --profile staging-admin && export AWS_PROFILE=staging-admin","handlingStrategy":"retry","validationCode":"// preflight the credentials with the AWS CLI before kops\n// aws ec2 describe-regions --region us-east-1 && kops ...","typeGuard":null,"tryCatchPattern":"err := kopsValidateRegion(ctx, region)\nif err != nil && strings.Contains(err.Error(), \"verify your AWS credentials\") {\n    // inspect the wrapped AWS error, refresh credentials, then retry\n    return refreshCredsAndRetry(ctx, region)\n}","preventionTips":["Preflight `aws ec2 describe-regions` in CI before cluster operations","Grant ec2:DescribeRegions to the automation IAM role","Verify proxy/egress allows ec2.<region>.amazonaws.com:443","Keep runner clocks synchronized"],"tags":["aws","ec2","credentials","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}