{"record":{"id":"a8fa8c222c4f2f1c","repo":"JuliusBrussee/caveman","slug":"awssig-incomplete-aws-credentials","errorCode":null,"errorMessage":"awssig: incomplete AWS credentials","messagePattern":"awssig: incomplete AWS credentials","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/awssig/awssig.go","lineNumber":70,"sourceCode":"}\n\n// Sign computes the SigV4 signature for req against the given payload and sets\n// the Authorization, X-Amz-Date, X-Amz-Content-Sha256 (and, when present,\n// X-Amz-Security-Token) headers on req. The Host header is derived from req.URL.\n//\n// payloadHash is the lowercase hex SHA-256 of the request body; pass\n// HashPayload(body) for the common case, or UnsignedPayload() for streaming\n// bodies that must not be buffered. now fixes the signing instant (use\n// time.Now().UTC()); it is a parameter so tests are deterministic.\n//\n// Sign returns an error only for malformed inputs (no region/service, missing\n// credentials, unparseable URL). It never returns the secret in the error.\nfunc (s Signer) Sign(req *http.Request, creds Credentials, payloadHash string, now time.Time) error {\n\tif s.Region == \"\" || s.Service == \"\" {\n\t\treturn fmt.Errorf(\"awssig: signer requires region and service\")\n\t}\n\tif !creds.Valid() {\n\t\treturn fmt.Errorf(\"awssig: incomplete AWS credentials\")\n\t}\n\tif req.URL == nil {\n\t\treturn fmt.Errorf(\"awssig: request has no URL\")\n\t}\n\tnow = now.UTC()\n\tamzDate := now.Format(\"20060102T150405Z\")\n\tdateStamp := now.Format(\"20060102\")\n\n\thost := req.URL.Host\n\tif req.Host != \"\" {\n\t\thost = req.Host\n\t}\n\treq.Header.Set(\"Host\", host)\n\treq.Header.Set(\"X-Amz-Date\", amzDate)\n\treq.Header.Set(\"X-Amz-Content-Sha256\", payloadHash)\n\tif creds.SessionToken != \"\" {\n\t\treq.Header.Set(\"X-Amz-Security-Token\", creds.SessionToken)\n\t}","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/awssig/awssig.go#L52-L88","documentation":"Sign found incomplete AWS credentials: the access key ID or secret (or the expected session token pairing) is missing from the resolved credential set. The signer fails before signing so requests are never sent with absent or half-present credentials; the error deliberately never echoes the secret.","triggerScenarios":"Thrown at shared/platform/awssig/awssig.go:70 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a complete credential set: access key ID, secret, and session token if using temporary credentials","Check that the credential chain/environment actually resolved all required fields"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}