{"record":{"id":"6e649288d0d0decf","repo":"argoproj/argo-workflows","slug":"failed-to-load-aws-config-w","errorCode":null,"errorMessage":"failed to load AWS config: %w","messagePattern":"failed to load AWS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/sqldb/aws_rds_auth.go","lineNumber":29,"sourceCode":"\t\"github.com/lib/pq\"\n)\n\ntype awsRDSConnector struct {\n\tdsn      string\n\tendpoint string\n\tusername string\n\tregion   string\n}\n\nfunc (c *awsRDSConnector) Connect(ctx context.Context) (driver.Conn, error) {\n\topts := []func(*awsconfig.LoadOptions) error{}\n\tif c.region != \"\" {\n\t\topts = append(opts, awsconfig.WithRegion(c.region))\n\t}\n\n\tawsCfg, err := awsconfig.LoadDefaultConfig(ctx, opts...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load AWS config: %w\", err)\n\t}\n\n\ttoken, err := auth.BuildAuthToken(ctx, c.endpoint, awsCfg.Region, c.username, awsCfg.Credentials)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build RDS auth token: %w\", err)\n\t}\n\n\t// Escape single quotes in token for safe DSN interpolation\n\tescapedToken := strings.ReplaceAll(token, \"'\", \"\\\\'\")\n\n\tdsnWithPassword := fmt.Sprintf(\"%s password='%s'\", c.dsn, escapedToken)\n\n\treturn pq.Driver{}.Open(dsnWithPassword)\n}\n\nfunc (c *awsRDSConnector) Driver() driver.Driver {\n\treturn pq.Driver{}\n}","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/sqldb/aws_rds_auth.go#L11-L47","documentation":"awsRDSConnector.Connect builds an IAM-authenticated Postgres connection by first loading the default AWS SDK v2 config (credentials, region). If awsconfig.LoadDefaultConfig cannot resolve a usable configuration, Connect wraps the SDK error with \"failed to load AWS config\". This is a startup/config-resolution failure, not a database failure.","triggerScenarios":"Calling Connect on awsRDSConnector when LoadDefaultConfig fails: no AWS credentials resolvable from env vars/shared config file/IMDS/ECS/IRSA, malformed AWS_SDK_LOAD_CONFIG file, invalid profile specified via AWS_PROFILE, or unparseable regional STS endpoints.","commonSituations":"Argo Workflows pod has no IRSA annotation or node role lacks access to the IMDS; running locally without ~/.aws/credentials or AWS_ACCESS_KEY_ID set; a typo'd AWS_PROFILE pointing at a non-existent profile; shared config file with invalid syntax.","solutions":["Ensure AWS credentials are available in the environment: attach an IRSA role to the workflow-controller/service pod, or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, or mount a valid ~/.aws/credentials.","If running in-cluster, verify access to EC2 IMDS or that AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set for ECS; disable IMDS requirement by setting explicit env credentials.","Check AWS_PROFILE and AWS_REGION / the connector's configured region for typos and validity.","Validate the shared AWS config/credentials files parse correctly (AWS_SDK_LOAD_CONFIG path, INI syntax).","Inspect the wrapped SDK error (the %w cause) for the exact resolution chain failure (e.g. 'failed to refresh cached credentials')."],"exampleFix":"// before (pod without credentials)\n# pod spec without service account\n// after\n# deploy.yaml\nspec:\n  template:\n    spec:\n      serviceAccountName: argo-server  # annotated with RDS IAM role (IRSA)","handlingStrategy":"validation","validationCode":"cfg, err := awsconfig.LoadDefaultConfig(ctx)\nif err != nil || cfg.Credentials == nil {\n    return fmt.Errorf(\"AWS config/credentials unavailable before connecting: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"var connErr * AWSResolutionError\nif err := openDB(); err != nil {\n    if strings.Contains(err.Error(), \"failed to load AWS config\") {\n        // do not retry blindly: fix credentials/env first\n        log.Fatal(err)\n    }\n}","preventionTips":["Attach an IRSA role or instance profile before deploying the controller.","Pre-flight `aws sts get-caller-identity` in the same pod/environment (debug container).","Document required AWS_* env vars in your deployment manifests.","Set AWS_REGION explicitly rather than relying on resolution order."],"tags":["aws","authentication","database","config"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}