{"record":{"id":"87cd81caf6303848","repo":"temporalio/temporal","slug":"unable-to-create-aws-http-client-for-elasticsearch","errorCode":null,"errorMessage":"unable to create AWS HTTP client for Elasticsearch: %w","messagePattern":"unable to create AWS HTTP client for Elasticsearch: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"temporal/fx.go","lineNumber":276,"sourceCode":"\n\tif persistenceConfig.SecondaryVisibilityConfigExist() &&\n\t\tpersistenceConfig.DataStores[persistenceConfig.SecondaryVisibilityStore].Elasticsearch != nil {\n\t\tesConfig = persistenceConfig.DataStores[persistenceConfig.SecondaryVisibilityStore].Elasticsearch\n\t\tesConfig.SetHttpClient(so.elasticsearchHttpClient)\n\t}\n\tif persistenceConfig.VisibilityConfigExist() &&\n\t\tpersistenceConfig.DataStores[persistenceConfig.VisibilityStore].Elasticsearch != nil {\n\t\tesConfig = persistenceConfig.DataStores[persistenceConfig.VisibilityStore].Elasticsearch\n\t\tesConfig.SetHttpClient(so.elasticsearchHttpClient)\n\t}\n\n\tif esConfig != nil {\n\t\tesHttpClient := so.elasticsearchHttpClient\n\t\tif esHttpClient == nil {\n\t\t\tvar err error\n\t\t\tesHttpClient, err = esclient.NewAwsHttpClient(esConfig.AWSRequestSigning)\n\t\t\tif err != nil {\n\t\t\t\treturn serverOptionsProvider{}, fmt.Errorf(\"unable to create AWS HTTP client for Elasticsearch: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\tesClient, err = esclient.NewClient(esConfig, esHttpClient, logger)\n\t\tif err != nil {\n\t\t\treturn serverOptionsProvider{}, fmt.Errorf(\"unable to create Elasticsearch client (URL = %v, username = %q): %w\",\n\t\t\t\tesConfig.URL.Redacted(), esConfig.Username, err)\n\t\t}\n\t}\n\n\t// check that when static hosts are defined, they are defined for all required hosts\n\tif len(so.hostsByService) > 0 {\n\t\tfor _, service := range DefaultServices {\n\t\t\thosts := so.hostsByService[primitives.ServiceName(service)]\n\t\t\tif len(hosts.All) == 0 {\n\t\t\t\treturn serverOptionsProvider{}, fmt.Errorf(\"%w: %v\", missingServiceInStaticHosts, service)\n\t\t\t}\n\t\t}","sourceCodeStart":258,"sourceCodeEnd":294,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/temporal/fx.go#L258-L294","documentation":"When Elasticsearch visibility storage is configured with AWS request signing, ServerOptionsProvider builds a signed-transport HTTP client via esclient.NewAwsHttpClient(esConfig.AWSRequestSigning). Failure (invalid signing config, bad AWS region/credentials setup) is wrapped as 'unable to create AWS HTTP client for Elasticsearch' and prevents server startup.","triggerScenarios":"esConfig visibility config with awsRequestSigning set but with an invalid/missing region, malformed signing options, or the AWS credentials chain failing at client construction.","commonSituations":"AWS-hosted Elasticsearch/OpenSearch without AWS_REGION set; typo in region (e.g. 'us-east-1a'); signing enabled but no credentials provider resolvable; missing v4 signing library configuration after version upgrade.","solutions":["Fix the wrapped inner error: set a valid AWS region and ensure credentials are resolvable (env vars, instance role, shared config)","Verify the AWSRequestSigning block in the visibility config matches the documented schema (region, and partitionID if required)","If signing is unnecessary (e.g. VPC-internal ES without auth), remove awsRequestSigning and use basic auth instead"],"exampleFix":"// before\nvisibilityStore:\n  elasticsearch:\n    awsRequestSigning:\n      region: \"\"\n// after\nvisibilityStore:\n  elasticsearch:\n    awsRequestSigning:\n      region: \"us-east-1\"","handlingStrategy":"validation","validationCode":"if sign := esCfg.AWSRequestSigning; sign != nil {\n    if sign.Region == \"\" { return fmt.Errorf(\"awsRequestSigning.region is required\") }\n    if _, err := ec2metadatacreds / chain resolution test; err != nil { return err }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set AWS_REGION and verify credentials resolve (aws sts get-caller-identity) before starting the server","Keep the AWSRequestSigning schema current with the server version's config docs","Use basic auth instead of request signing when the ES cluster does not require AWS SigV4"],"tags":["elasticsearch","aws","config","startup","go"],"backgroundTag":"aws-signing-config-invalid","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}