{"record":{"id":"aa92efabc8d2d018","repo":"kubernetes/kops","slug":"failed-to-load-aws-config-w-aa92ef","errorCode":null,"errorMessage":"failed to load AWS config: %w","messagePattern":"failed to load AWS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/context.go","lineNumber":229,"sourceCode":"\t\treturn c.buildOpenstackSwiftPath(p)\n\t}\n\n\tif strings.HasPrefix(p, \"azureblob://\") {\n\t\treturn c.buildAzureBlobPath(p)\n\t}\n\n\tif strings.HasPrefix(p, \"scw://\") {\n\t\treturn c.buildSCWPath(p)\n\t}\n\n\treturn nil, fmt.Errorf(\"unknown / unhandled path type: %q\", p)\n}\n\n// readAWSMetadata reads the specified path from the AWS EC2 metadata service\nfunc (c *VFSContext) readAWSMetadata(ctx context.Context, path string) ([]byte, error) {\n\tconfig, err := awsconfig.LoadDefaultConfig(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load AWS config: %w\", err)\n\t}\n\n\tclient := imds.NewFromConfig(config)\n\n\tif strings.HasPrefix(path, \"/meta-data/\") {\n\t\ts, err := client.GetMetadata(ctx, &imds.GetMetadataInput{\n\t\t\tPath: strings.TrimPrefix(path, \"/meta-data/\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from AWS metadata service: %v\", err)\n\t\t}\n\t\tdefer s.Content.Close()\n\t\treturn io.ReadAll(s.Content)\n\t}\n\t// There are others (e.g. user-data), but as we don't use them yet let's not expose them\n\treturn nil, fmt.Errorf(\"unhandled aws metadata path %q\", path)\n}\n","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/context.go#L211-L247","documentation":"readAWSMetadata (reached via metadata://aws/... URLs in ReadFile) first calls aws-sdk-go-v2 config.LoadDefaultConfig. If the AWS SDK cannot assemble a usable configuration (bad credential chain, invalid shared config file, unusable region), the error is wrapped as 'failed to load AWS config'.","triggerScenarios":"Calling ReadFile('metadata://aws/...') on a machine where LoadDefaultConfig fails: malformed ~/.aws/config or ~/.aws/credentials, invalid AWS_PROFILE, malformed AWS_* environment variables, or explicitly-configured sources that error (e.g. bad assume-role config, invalid SSO settings).","commonSituations":"Running a kOps binary on an EC2 host with a corrupted AWS config file; exporting AWS_REGION='' or a syntactically invalid profile; SSO token cache expired with cached profile settings.","solutions":["Run `aws sts get-caller-identity` to verify the SDK default config loads; fix whatever it reports","Inspect ~/.aws/config and ~/.aws/credentials for syntax errors and fix them","Unset conflicting AWS_* env vars (AWS_PROFILE, AWS_CONFIG_FILE, AWS_ROLE_ARN/AWS_WEB_IDENTITY_TOKEN_FILE) or set them correctly","Ensure AWS_REGION or a default region is resolvable if the error is region-related"],"exampleFix":"// before\nexport AWS_PROFILE=\"nonexistent-profile\"\n// after\nexport AWS_PROFILE=\"default\" # or a profile present in ~/.aws/config","handlingStrategy":"try-catch","validationCode":"if _, err := awsconfig.LoadDefaultConfig(context.TODO()); err != nil {\n\treturn fmt.Errorf(\"AWS SDK config cannot load; fix ~/.aws config/env before running: %w\", err)\n}","typeGuard":"func awsConfigLoadable(ctx context.Context) bool {\n\t_, err := awsconfig.LoadDefaultConfig(ctx)\n\treturn err == nil\n}","tryCatchPattern":"data, err := vfs.Context.ReadFile(\"metadata://aws/meta-data/instance-id\")\nif err != nil && strings.Contains(err.Error(), \"failed to load AWS config\") {\n\treturn fmt.Errorf(\"check AWS credentials/config (~/.aws, AWS_* env vars, profile): %w\", err)\n}","preventionTips":["Run `aws sts get-caller-identity` as a preflight in scripts/CI","Pin a valid AWS_PROFILE and region explicitly rather than relying on discovery","Keep ~/.aws/config syntactically valid; avoid half-written SSO/assume-role settings"],"tags":["aws","config","credentials"],"backgroundTag":"aws-credential-chain-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}