{"record":{"id":"9fe9a2e29ddc434b","repo":"Tencent/WeKnora","slug":"failed-to-load-aws-config-w","errorCode":null,"errorMessage":"failed to load AWS config: %w","messagePattern":"failed to load AWS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/s3.go","lineNumber":55,"sourceCode":"\tvar cfg aws.Config\n\tvar err error\n\n\t// With no explicit AK/SK, keep the AWS default credential chain intact. This\n\t// supports IAM roles for EC2/ECS/EKS (IRSA), web identity, shared config, and\n\t// environment credentials without persisting long-lived keys in WeKnora.\n\tloadOptions := []func(*config.LoadOptions) error{config.WithRegion(region)}\n\tif accessKey != \"\" || secretKey != \"\" {\n\t\tif accessKey == \"\" || secretKey == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"S3 access key and secret key must be provided together\")\n\t\t}\n\t\tloadOptions = append(loadOptions, config.WithCredentialsProvider(\n\t\t\tcredentials.NewStaticCredentialsProvider(accessKey, secretKey, \"\"),\n\t\t))\n\t}\n\tcfg, err = config.LoadDefaultConfig(context.Background(), loadOptions...)\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load AWS config: %w\", err)\n\t}\n\n\t// Create S3 client with custom endpoint if provided.\n\t// For S3-compatible services (non-AWS), use path-style addressing\n\t// (endpoint/bucket/key) instead of virtual-hosted style (bucket.endpoint/key).\n\thttpClient := utils.NewSSRFSafeHTTPClient(utils.DefaultSSRFSafeHTTPClientConfig())\n\tvar client *s3.Client\n\tif endpoint != \"\" {\n\t\tusePathStyle := forcePathStyle || !strings.Contains(endpoint, \"amazonaws.com\")\n\t\tclient = s3.NewFromConfig(cfg, func(o *s3.Options) {\n\t\t\to.BaseEndpoint = aws.String(endpoint)\n\t\t\to.UsePathStyle = usePathStyle\n\t\t\tif !strings.Contains(endpoint, \"amazonaws.com\") {\n\t\t\t\t// S3-compatible services commonly reject the SDK's default\n\t\t\t\t// trailing checksum negotiation. Only relax this for explicit\n\t\t\t\t// non-AWS endpoints; standard AWS S3 keeps its default behavior.\n\t\t\t\to.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired\n\t\t\t}","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/s3.go#L37-L73","documentation":"newS3Client calls config.LoadDefaultConfig to build the aws.Config (region plus optional credential chain). This error wraps any failure from that load — usually invalid credential chain resolution or a bad region/config file — so an S3 client could not be constructed at all.","triggerScenarios":"Calling NewS3FileService when the AWS SDK config loader fails: malformed shared credentials/config files, invalid static credentials rejected by the provider, bad AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE env, or SDK errors resolving the default chain.","commonSituations":"Corrupted ~/.aws/credentials after manual edits, invalid characters in AK/SK pulled from a secret store, AWS_SDK_LOAD_CONFIG issues, SDK version mismatches after upgrading aws-sdk-go-v2.","solutions":["Inspect the wrapped error for the exact config-load failure","Validate the shared credentials/config files parse correctly (aws CLI: aws sts get-caller-identity)","Confirm the region string is a valid AWS region identifier","If using static credentials, verify AK/SK contain no whitespace or newlines"],"exampleFix":"// before\ncfg, err = config.LoadDefaultConfig(context.Background(), loadOptions...)\nif err != nil { return nil, fmt.Errorf(\"failed to load AWS config: %w\", err) }\n// after\n// fix the cause indicated by %w, e.g. trim credentials:\naccessKey = strings.TrimSpace(accessKey)\nsecretKey = strings.TrimSpace(secretKey)\ncfg, err = config.LoadDefaultConfig(context.Background(), loadOptions...)","handlingStrategy":"try-catch","validationCode":"if accessKey != \"\" && (strings.ContainsAny(accessKey, \" \\n\\r\") || strings.ContainsAny(secretKey, \" \\n\\r\")) {\n    return errors.New(\"credentials contain whitespace/newlines\")\n}\nif region == \"\" { return errors.New(\"region is required\") }","typeGuard":null,"tryCatchPattern":"svc, err := NewS3FileService(endpoint, ak, sk, bucket, region, prefix)\nif err != nil && strings.Contains(err.Error(), \"failed to load AWS config\") {\n    return fmt.Errorf(\"startup failed (check ~/.aws config and credentials): %w\", err)\n}","preventionTips":["Trim credentials read from env/secrets to strip stray newlines","Validate shared credentials files with the AWS CLI before deploy","Pin aws-sdk-go-v2 versions and review changelogs on upgrade","Always set an explicit region"],"tags":["aws","config","credentials","s3"],"backgroundTag":"aws-config-load-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}