{"record":{"id":"5e56dd5cdac9311c","repo":"kubernetes/kops","slug":"s3-access-key-id-cannot-be-empty-when-s3-endpoint","errorCode":null,"errorMessage":"S3_ACCESS_KEY_ID cannot be empty when S3_ENDPOINT is not empty","messagePattern":"S3_ACCESS_KEY_ID cannot be empty when S3_ENDPOINT is not empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/s3context.go","lineNumber":128,"sourceCode":"\t\t// Use customized S3 storage\n\t\tklog.V(2).Infof(\"Found S3_ENDPOINT=%q, using as non-AWS S3 backend\", endpoint)\n\t\tconfig, err = getCustomS3Config(ctx, region)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\ts3Client := s3.NewFromConfig(config, optFn)\n\n\ts.clients[region] = s3Client\n\n\treturn s3Client, nil\n}\n\nfunc getCustomS3Config(ctx context.Context, region string) (aws.Config, error) {\n\taccessKeyID := os.Getenv(\"S3_ACCESS_KEY_ID\")\n\tif accessKeyID == \"\" {\n\t\treturn aws.Config{}, fmt.Errorf(\"S3_ACCESS_KEY_ID cannot be empty when S3_ENDPOINT is not empty\")\n\t}\n\tsecretAccessKey := os.Getenv(\"S3_SECRET_ACCESS_KEY\")\n\tif secretAccessKey == \"\" {\n\t\treturn aws.Config{}, fmt.Errorf(\"S3_SECRET_ACCESS_KEY cannot be empty when S3_ENDPOINT is not empty\")\n\t}\n\n\ts3Config, err := awsconfig.LoadDefaultConfig(ctx,\n\t\tawsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, \"\")),\n\t\tawsconfig.WithRegion(region),\n\t)\n\tif err != nil {\n\t\treturn aws.Config{}, fmt.Errorf(\"error loading AWS config: %v\", err)\n\t}\n\treturn s3Config, nil\n}\n\nfunc (s *S3Context) getDetailsForBucket(ctx context.Context, bucket string) (*S3BucketDetails, error) {\n\ts.mutex.Lock()","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/s3context.go#L110-L146","documentation":"Configuration guard in getCustomS3Config: a non-AWS S3 endpoint was supplied via S3_ENDPOINT (static credentials mode), but the S3_ACCESS_KEY_ID environment variable is empty. Custom endpoints cannot use AWS SigV4 credential chains, so an explicit access key is mandatory and client construction aborts.","triggerScenarios":"Thrown at util/pkg/vfs/s3context.go:128 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Export S3_ACCESS_KEY_ID with the access key for the custom S3-compatible backend","Or clear S3_ENDPOINT to use standard AWS credential resolution"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}