{"record":{"id":"6db8174e383baf50","repo":"kubernetes/kops","slug":"error-loading-aws-config-v-6db817","errorCode":null,"errorMessage":"error loading AWS config: %v","messagePattern":"error loading AWS config: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/pkg/vfs/s3context.go","lineNumber":107,"sourceCode":"\ts.mutex.Lock()\n\tdefer s.mutex.Unlock()\n\n\tif s3Client := s.clients[region]; s3Client != nil {\n\t\treturn s3Client, nil\n\t}\n\n\t// Client configuration is determined by region and process-wide environment.\n\t// The first request for a region creates the shared client for that region.\n\t_, span := tracer.Start(ctx, \"S3Context::getClient\")\n\tdefer span.End()\n\n\tvar config aws.Config\n\tvar err error\n\tendpoint := os.Getenv(\"S3_ENDPOINT\")\n\tif endpoint == \"\" {\n\t\tconfig, err = awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error loading AWS config: %v\", err)\n\t\t}\n\t} else {\n\t\t// Use customized S3 storage\n\t\tklog.V(2).Infof(\"Found S3_ENDPOINT=%q, using as non-AWS S3 backend\", endpoint)\n\t\tconfig, err = getCustomS3Config(ctx, region)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\ts3Client := s3.NewFromConfig(config, optFn)\n\n\ts.clients[region] = s3Client\n\n\treturn s3Client, nil\n}\n\nfunc getCustomS3Config(ctx context.Context, region string) (aws.Config, error) {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/s3context.go#L89-L125","documentation":"The S3 VFS client builds an AWS SDK v2 config via config.LoadDefaultConfig when S3_ENDPOINT is unset. If credential/region resolution fails (no credentials found, invalid profile, etc.), getClient wraps the failure in 'error loading AWS config'.","triggerScenarios":"First use of an s3:// vfs path (getDetailsForBucket, client, hasServerSideEncryptionByDefault) when LoadDefaultConfig cannot resolve a region or credentials from env/shared config/IMDS.","commonSituations":"Running kops in an environment without AWS credentials (missing ~/.aws/credentials, no AWS_ACCESS_KEY_ID), an invalid AWS_PROFILE, no default region, or broken IMDS on EC2.","solutions":["Ensure valid AWS credentials are available: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (or aws configure) and verify with 'aws sts get-caller-identity'","Set AWS_REGION or the region in your profile/config so LoadDefaultConfig resolves a region","Check AWS_PROFILE points to an existing profile and shared config files are readable","On EC2, verify the instance role and IMDS (169.254.169.254) are reachable","If targeting non-AWS S3, set S3_ENDPOINT (and S3_REGION/S3_ACCESS_KEY_ID etc.) to use the custom-config branch instead"],"exampleFix":"// before\nexport AWS_PROFILE=nope\nkops get cluster --state s3://bucket // error loading AWS config\n// after\nexport AWS_PROFILE=default AWS_REGION=us-east-1\naws sts get-caller-identity # verify, then retry kops","handlingStrategy":"validation","validationCode":"func awsConfigReady() error {\n  if os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" {\n    if _, err := os.Stat(filepath.Join(os.Getenv(\"HOME\"), \".aws\", \"credentials\")); err != nil {\n      return errors.New(\"no AWS credentials found (env or ~/.aws/credentials)\")\n    }\n  }\n  if os.Getenv(\"AWS_REGION\") == \"\" && os.Getenv(\"AWS_DEFAULT_REGION\") == \"\" && os.Getenv(\"AWS_PROFILE\") == \"\" {\n    return errors.New(\"no AWS region resolvable; set AWS_REGION\")\n  }\n  return nil\n}","typeGuard":"null","tryCatchPattern":"_, err := vfs.Context.ReadLocation(ctx, \"s3://bucket/path\")\nif err != nil && strings.Contains(err.Error(), \"error loading AWS config\") {\n    return fmt.Errorf(\"AWS credentials/region missing: %w; run aws configure or set AWS_REGION\", err)\n}","preventionTips":["Run 'aws sts get-caller-identity' before kops operations to verify credentials","Always set AWS_REGION or a default region in ~/.aws/config","Keep only valid entries in AWS_PROFILE; remove stale profiles","On EC2 check instance role and IMDSv2 reachability","For non-AWS S3, set S3_ENDPOINT plus custom credentials explicitly"],"tags":["aws","s3","config","credentials"],"backgroundTag":"aws-config-load-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}