{"record":{"id":"712199c60bd4202f","repo":"grafana/k6","slug":"sigv4-seems-to-be-partially-configured-all-of-k6","errorCode":null,"errorMessage":"sigv4 seems to be partially configured. All of K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY must all be set. Unset all to bypass sigv4","messagePattern":"sigv4 seems to be partially configured\\. All of K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY must all be set\\. Unset all to bypass sigv4","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/output/prometheusrw/remotewrite/config.go","lineNumber":141,"sourceCode":"\tif conf.TLSMinVersion.Valid && conf.TLSMinVersion.String == \"1.2\" {\n\t\ttlsMinVersion = tls.VersionTLS12\n\t}\n\n\thc.TLSConfig = &tls.Config{\n\t\tInsecureSkipVerify: conf.InsecureSkipTLSVerify.Bool, //nolint:gosec\n\t\tMinVersion:         tlsMinVersion,\n\t}\n\n\tif conf.ClientCertificate.Valid && conf.ClientCertificateKey.Valid {\n\t\tcert, err := tls.LoadX509KeyPair(conf.ClientCertificate.String, conf.ClientCertificateKey.String)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load the TLS certificate: %w\", err)\n\t\t}\n\t\thc.TLSConfig.Certificates = []tls.Certificate{cert}\n\t}\n\n\tif isSigV4PartiallyConfigured(conf.SigV4Region, conf.SigV4AccessKey, conf.SigV4SecretKey) {\n\t\treturn nil, errors.New(\n\t\t\t\"sigv4 seems to be partially configured. All of \" +\n\t\t\t\t\"K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY \" +\n\t\t\t\t\"must all be set. Unset all to bypass sigv4\",\n\t\t)\n\t}\n\n\tif conf.SigV4Region.Valid && conf.SigV4AccessKey.Valid && conf.SigV4SecretKey.Valid {\n\t\thc.SigV4 = &sigv4.Config{\n\t\t\tRegion:             conf.SigV4Region.String,\n\t\t\tAwsAccessKeyID:     conf.SigV4AccessKey.String,\n\t\t\tAwsSecretAccessKey: conf.SigV4SecretKey.String,\n\t\t}\n\t}\n\n\tif len(conf.Headers) > 0 {\n\t\thc.Headers = make(http.Header)\n\t\tfor k, v := range conf.Headers {\n\t\t\thc.Headers.Add(k, v)","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/output/prometheusrw/remotewrite/config.go#L123-L159","documentation":"Thrown by the Prometheus remote-write output's config loader when the three sigv4 fields (region, access key, secret key) are neither all set nor all unset — isSigV4PartiallyConfigured treats a null.String as set only when Valid and non-blank. AWS SigV4 signing requires the complete triplet, so a partial set is rejected rather than silently sending unsigned or half-signed requests.","triggerScenarios":"Setting K6_PROMETHEUS_RW_SIGV4_REGION but not the access/secret keys; exporting K6_PROMETHEUS_RW_SIGV4_SECRET_KEY from a secret store while the other two come from a different, failed source; a variable expanding to empty string in CI (which still counts as unset here but combined with others set elsewhere); JSON config with only some sigv4 fields.","commonSituations":"CI pipelines where the secret key is injected by a vault but the region was hardcoded in only one job; splitting config across multiple env files where one is not sourced; renaming variables (e.g. K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY vs ..._ACCESS_KEY_ID) so one is silently missing.","solutions":["Set all three: K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY","If SigV4 is not wanted, unset all three env vars to send unsigned remote-write requests","Print which of the three are non-empty in your runner before k6 starts (without leaking values) to find the missing one"],"exampleFix":"# before\nexport K6_PROMETHEUS_RW_SIGV4_REGION=us-east-1\nexport K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY=AKIA...\n# secret key missing -> error\n\n# after\nexport K6_PROMETHEUS_RW_SIGV4_REGION=us-east-1\nexport K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY=AKIA...\nexport K6_PROMETHEUS_RW_SIGV4_SECRET_KEY=...\n\n# or bypass sigv4 entirely:\nunset K6_PROMETHEUS_RW_SIGV4_REGION K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY K6_PROMETHEUS_RW_SIGV4_SECRET_KEY","handlingStrategy":"validation","validationCode":"SIGV4_VARS=(K6_PROMETHEUS_RW_SIGV4_REGION K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY K6_PROMETHEUS_RW_SIGV4_SECRET_KEY)\nset_count=0\nfor v in \"${SIGV4_VARS[@]}\"; do [ -n \"${!v:-}\" ] && set_count=$((set_count+1)); done\n[ \"$set_count\" -eq 0 ] || [ \"$set_count\" -eq 3 ] || { echo \"sigv4 requires all three vars set or none; got $set_count\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inject the sigv4 triplet from a single secret bundle so they arrive together","Never hardcode one field in the image and fetch the others at runtime","Log (names only) which sigv4 vars are present in CI job headers for quick diagnosis"],"tags":["k6","prometheus","remote-write","aws","sigv4","credentials"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}