{"record":{"id":"811b987da8d81924","repo":"temporalio/temporal","slug":"failed-to-sign-request-w","errorCode":null,"errorMessage":"failed to sign request: %w","messagePattern":"failed to sign request: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/persistence/visibility/store/elasticsearch/client/aws.go","lineNumber":46,"sourceCode":"func (t *awsSigningTransport) RoundTrip(req *http.Request) (*http.Response, error) {\n\tcreds, err := t.creds.Retrieve(req.Context())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve AWS credentials: %w\", err)\n\t}\n\n\tvar bodyBytes []byte\n\tif req.Body != nil {\n\t\tbodyBytes, err = io.ReadAll(req.Body)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read request body: %w\", err)\n\t\t}\n\t\treq.Body = io.NopCloser(bytes.NewReader(bodyBytes))\n\t}\n\n\thash := fmt.Sprintf(\"%x\", sha256.Sum256(bodyBytes))\n\terr = t.signer.SignHTTP(req.Context(), creds, req, hash, t.service, t.region, time.Now())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to sign request: %w\", err)\n\t}\n\n\tif bodyBytes != nil {\n\t\t// set the request body just in case the signer consumes the body\n\t\treq.Body = io.NopCloser(bytes.NewReader(bodyBytes))\n\t}\n\n\treturn t.wrapped.RoundTrip(req)\n}\n\nfunc NewAwsHttpClient(config ESAWSRequestSigningConfig) (*http.Client, error) {\n\tif !config.Enabled {\n\t\treturn nil, nil\n\t}\n\n\tif config.Region == \"\" {\n\t\tconfig.Region = os.Getenv(\"AWS_REGION\")\n\t\tif config.Region == \"\" {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/persistence/visibility/store/elasticsearch/client/aws.go#L28-L64","documentation":"After obtaining credentials and computing the payload hash, RoundTrip calls the AWS SDK v4 signer's SignHTTP to apply the SigV4 signature to the outgoing Elasticsearch request. If the signing operation itself fails, the request is aborted with this error.","triggerScenarios":"SignHTTP fails when req.Context() is canceled or times out during signing, when the signing time/clock handling breaks, or when a non-fatal signer error surfaces for the configured service ('es') and region — for example signing with a region value that is invalid or missing.","commonSituations":"Server clock skewed so far that signing fails; empty/garbage region string passed via ESAWSRequestSigningConfig leading to signer errors; context deadlines canceled under load; misconfigured AWS SDK version mismatch in builds.","solutions":["Check req.Context() cancellation — if context deadline exceeded, tune the visibility client timeout or investigate latency","Validate the configured signing region (es config region or AWS_REGION) is a valid AWS region code","Ensure server NTP clock sync — large clock skew breaks SigV4 signing","Retry transient cancellations; verify aws-sdk-go-v2 signer is correctly initialized and up to date"],"exampleFix":"// before (config missing/invalid region)\nvisibilityStore:\n  esaws:\n    enabled: true\n    region: \"\"\n// after\nvisibilityStore:\n  esaws:\n    enabled: true\n    region: \"us-east-1\"","handlingStrategy":"try-catch","validationCode":"// validate region before constructing the signing client\nif signingCfg.Region == \"\" {\n    return fmt.Errorf(\"ES AWS signing requires a region\")\n}","typeGuard":null,"tryCatchPattern":"resp, err := client.Do(req)\nif err != nil && strings.Contains(err.Error(), \"failed to sign request\") {\n    if errors.Is(req.Context().Err(), context.DeadlineExceeded) {\n        // retry with a longer deadline\n    }\n    ...\n}","preventionTips":["Set a valid AWS region string in the signing config","Keep service clocks NTP-synchronized (SigV4 is time-sensitive)","Avoid extremely tight HTTP deadlines that cancel requests during signing","Pin and periodically update aws-sdk-go-v2 dependencies"],"tags":["go","aws","elasticsearch","sigv4","signing","http"],"backgroundTag":"sigv4-signing-failed","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}