{"record":{"id":"b620610b99ff7de2","repo":"openai/codex","slug":"aws-profile-must-be-configured","errorCode":null,"errorMessage":"AWS profile must be configured","messagePattern":"AWS profile must be configured","errorType":"exception","errorClass":"AwsAuthError","httpStatus":null,"severity":"error","filePath":"codex-rs/aws-auth/src/lib.rs","lineNumber":47,"sourceCode":"    pub method: Method,\n    pub url: String,\n    pub headers: HeaderMap,\n    pub body: Bytes,\n}\n\n/// Signed request parts returned to the caller.\n#[derive(Debug, Clone, PartialEq, Eq)]\npub struct AwsSignedRequest {\n    pub url: String,\n    pub headers: HeaderMap,\n}\n\n/// Errors returned by credential loading or SigV4 signing.\n#[derive(Debug, Error)]\npub enum AwsAuthError {\n    #[error(\"AWS service name must not be empty\")]\n    EmptyService,\n    #[error(\"AWS profile must be configured\")]\n    MissingProfile,\n    #[error(\"AWS SDK config did not resolve a credentials provider\")]\n    MissingCredentialsProvider,\n    #[error(\"AWS SDK config did not resolve a region\")]\n    MissingRegion,\n    #[error(\"failed to load AWS profiles: {0}\")]\n    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),\n    #[error(\"failed to load AWS credentials: {0}\")]\n    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),\n    #[error(\"request URL is not a valid URI: {0}\")]\n    InvalidUri(#[source] http::uri::InvalidUri),\n    #[error(\"failed to construct HTTP request for signing: {0}\")]\n    BuildHttpRequest(#[source] http::Error),\n    #[error(\"request contains a non-UTF8 header value: {0}\")]\n    InvalidHeaderValue(#[source] http::header::ToStrError),\n    #[error(\"failed to build signable request: {0}\")]\n    SigningRequest(#[source] aws_sigv4::http_request::SigningError),\n    #[error(\"failed to build SigV4 signing params: {0}\")]","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/aws-auth/src/lib.rs#L29-L65","documentation":"AwsAuthContext::load_profile requires an explicitly named profile: it returns AwsAuthError::MissingProfile immediately when AwsAuthConfig.profile is None. The plain AwsAuthContext::load entry point does not raise this - it uses default AWS SDK credential-chain resolution. Non-retryable per is_retryable().","triggerScenarios":"Passing AwsAuthConfig with profile: None to load_profile; the profile field populated from an optional env var or config key that was unset (e.g. forgot to read AWS_PROFILE into the struct).","commonSituations":"Code switched from load() to load_profile() without guaranteeing the profile field is set; AWS_PROFILE-driven setups where the app never copied the env var into AwsAuthConfig.","solutions":["Set AwsAuthConfig.profile = Some(\"profilename\") before calling load_profile","Or call AwsAuthContext::load to use the default credential chain (env vars, shared config, IMDS) with no profile","Source the profile name from AWS_PROFILE or your config schema with a required-field check"],"exampleFix":"// before\nlet ctx = AwsAuthContext::load_profile(AwsAuthConfig {\n    profile: None, region: None, service: \"s3\".into(),\n}).await?; // MissingProfile\n\n// after\nlet ctx = AwsAuthContext::load_profile(AwsAuthConfig {\n    profile: Some(std::env::var(\"AWS_PROFILE\")?), region: None, service: \"s3\".into(),\n}).await?;","handlingStrategy":"validation","validationCode":"let profile = std::env::var(\"AWS_PROFILE\").ok()\n    .or_else(|| config.aws_profile.clone())\n    .filter(|p| !p.trim().is_empty())\n    .ok_or(\"AWS profile required for load_profile\")?;\nlet ctx = AwsAuthContext::load_profile(AwsAuthConfig { profile: Some(profile), ..config }).await?;","typeGuard":"fn is_missing_profile(e: &AwsAuthError) -> bool {\n    matches!(e, AwsAuthError::MissingProfile)\n}","tryCatchPattern":"match AwsAuthContext::load_profile(cfg).await {\n    Err(AwsAuthError::MissingProfile) => AwsAuthContext::load(cfg).await, // fallback to default chain\n    other => other,\n}","preventionTips":["Guarantee profile.is_some() before calling load_profile, or call load when a profile is optional","Read AWS_PROFILE into your config explicitly rather than assuming ambient behavior"],"tags":["rust","aws","configuration","profile"],"backgroundTag":"missing-aws-profile","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}