{"record":{"id":"aeef8ae790ee90c3","repo":"kubernetes/kops","slug":"error-initializing-aws-client-v","errorCode":null,"errorMessage":"error initializing AWS client: %v","messagePattern":"error initializing AWS client: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/delete_cluster.go","lineNumber":124,"sourceCode":"\tclusterName := options.ClusterName\n\tif clusterName == \"\" {\n\t\treturn fmt.Errorf(\"--name is required (for safety)\")\n\t}\n\n\tvar cloud fi.Cloud\n\tvar cluster *kopsapi.Cluster\n\tvar err error\n\n\tif options.External {\n\t\tregion := options.Region\n\t\tif region == \"\" {\n\t\t\treturn fmt.Errorf(\"--region is required (when --external)\")\n\t\t}\n\n\t\ttags := map[string]string{\"KubernetesCluster\": clusterName}\n\t\tcloud, err = awsup.NewAWSCloud(region, tags)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error initializing AWS client: %v\", err)\n\t\t}\n\t} else {\n\t\tcluster, err = GetCluster(ctx, f, clusterName)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\twouldDeleteCloudResources := false\n\n\tif !options.Unregister {\n\t\tif cloud == nil {\n\t\t\tcloud, err = cloudup.BuildCloud(cluster)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/delete_cluster.go#L106-L142","documentation":"In the --external delete path, kOps calls awsup.NewAWSCloud(region, tags) to build the AWS SDK client. If that initialization fails (bad region string, missing/invalid credentials, network issues fetching account info), the error is wrapped with this message.","triggerScenarios":"awsup.NewAWSCloud returns an error: invalid region name, no AWS credentials found (env, shared config, instance profile), or inability to validate the account/zone against EC2 APIs.","commonSituations":"AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY not set or expired; `aws configure` never run; typo'd region (e.g. us-east-1a instead of us-east-1); IAM instance profile lacking EC2 permissions; corporate network blocking EC2 endpoints.","solutions":["Verify AWS credentials are present and valid (aws sts get-caller-identity).","Check the --region value is a valid AWS region identifier.","Ensure network access to the EC2 endpoint (proxy/VPN settings) and that the credentials' IAM policy allows the needed EC2 read calls."],"exampleFix":"// before\nexport AWS_REGION=\"us-east1\"  # invalid\n// after\nexport AWS_REGION=\"us-east-1\"\naws sts get-caller-identity  # verify credentials before retrying","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" || os.Getenv(\"AWS_SECRET_ACCESS_KEY\") == \"\" {\n    return fmt.Errorf(\"AWS credentials must be configured (env, shared config, or instance profile)\")\n}\nif !isValidAWSRegion(region) {\n    return fmt.Errorf(\"invalid AWS region %q\", region)\n}","typeGuard":null,"tryCatchPattern":"err := runDeleteCluster(...)\nif err != nil && strings.Contains(err.Error(), \"error initializing AWS client\") {\n    // check credentials/region/network, then retry once\n}","preventionTips":["Run `aws sts get-caller-identity` as a preflight in scripts.","Validate the region string before invoking kops.","Ensure the IAM role has EC2 describe permissions."],"tags":["aws","credentials","configuration"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}