{"record":{"id":"ab12caf6a4766090","repo":"kubernetes/kops","slug":"failed-to-load-aws-config-w-ab12ca","errorCode":null,"errorMessage":"failed to load aws config: %w","messagePattern":"failed to load aws config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":74,"sourceCode":"// RegionFromMetadata returns the current region from the aws metdata\nfunc RegionFromMetadata(ctx context.Context) (string, error) {\n\tcfg, err := awsconfig.LoadDefaultConfig(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to load default aws config: %w\", err)\n\t}\n\tmetadata := imds.NewFromConfig(cfg)\n\n\tresp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get region from ec2 metadata: %w\", err)\n\t}\n\treturn resp.Region, nil\n}\n\nfunc NewAWSAuthenticator(ctx context.Context, region string) (bootstrap.Authenticator, error) {\n\tconfig, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load aws config: %w\", err)\n\t}\n\treturn &awsAuthenticator{\n\t\tcredentialsProvider: config.Credentials,\n\t\tregion:              region,\n\t\tsts:                 sts.NewFromConfig(config),\n\t}, nil\n}\n\n// awsV1Token is the format of the V1 request, it matches http.Header\ntype awsV1Token map[string][]string\n\n// awsV2Token is the format of the V2 request, it maps to the http request generated by STS GetCallerIdentity\ntype awsV2Token struct {\n\tURL          string      `json:\"url\"`\n\tMethod       string      `json:\"method\"`\n\tSignedHeader http.Header `json:\"headers\"`\n}\n","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L56-L92","documentation":"NewAWSAuthenticator builds an awsAuthenticator from an explicitly provided region: it calls awsconfig.LoadDefaultConfig with WithRegion(region) and wires credentials and an STS client. If loading the default config fails (malformed shared config/credentials, invalid profile chain), the SDK error is wrapped with this message. Called from bootstrap client Build and getNodeConfigFromServers.","triggerScenarios":"Calling NewAWSAuthenticator(ctx, region) where the ambient AWS config chain fails: broken ~/.aws/config syntax, AWS_PROFILE referencing a missing profile, invalid source_profile/role_arn chains, or bad AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE paths.","commonSituations":"Using kops bootstrap on a bastion/CI runner whose AWS config file was hand-edited; role assumption chain in shared config pointing at a nonexistent profile; permissions issue reading the credentials file in a container.","solutions":["Validate the ambient config with `aws sts get-caller-identity --region <region>`; fix syntax or profile errors in ~/.aws/config and ~/.aws/credentials.","Unset/fix AWS_PROFILE, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE, and ensure credential process/plugin referenced by the profile works.","In containers/CI, mount or generate valid credentials (instance role or static keys) and confirm the file is readable by the running user."],"exampleFix":"// before (~/.aws/config)\n[profile kops]\nsource_profile = does-not-exist\n// after\n[profile kops]\nrole_arn = arn:aws:iam::123456789012:role/kops\nsource_profile = default","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"auth, err := awsbootstrap.NewAWSAuthenticator(ctx, region)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to load aws config\") {\n        return fmt.Errorf(\"check AWS shared config/profiles for region %s: %w\", region, err)\n    }\n    return err\n}","preventionTips":["Run `aws sts get-caller-identity` in the same environment before invoking bootstrap commands.","Keep AWS_PROFILE, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE unset or valid in CI images.","Verify referenced source_profile entries exist and are assumable in ~/.aws/config.","Ensure the credentials file is readable by the user running kops."],"tags":["go","aws","aws-sdk-go-v2","credentials","bootstrap"],"backgroundTag":"aws-config-load-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}