{"record":{"id":"c164446ebc38f0dd","repo":"kubernetes/kops","slug":"failed-to-load-aws-config-w-c16444","errorCode":null,"errorMessage":"failed to load AWS config: %w","messagePattern":"failed to load AWS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/s3context.go","lineNumber":349,"sourceCode":"\t}\n\tklog.V(2).Infof(\"GOOS=%q, assuming not running on EC2\", runtime.GOOS)\n\treturn false, nil\n}\n\n// getRegionFromMetadata queries the metadata service for the current region, if running in EC2\nfunc getRegionFromMetadata(ctx context.Context) (string, error) {\n\tctx, span := tracer.Start(ctx, \"getRegionFromMetadata\")\n\tdefer span.End()\n\n\t// Use an even shorter timeout, to minimize impact when not running on EC2\n\t// Note that we still retry a few times, this works out a little under a 1s delay\n\tshortTimeout := &http.Client{\n\t\tTimeout: 100 * time.Millisecond,\n\t}\n\n\tconfig, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithHTTPClient(shortTimeout))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to load AWS config: %w\", err)\n\t}\n\n\tclient := imds.NewFromConfig(config)\n\n\tmetadataRegion, err := client.GetRegion(ctx, &imds.GetRegionInput{})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting AWS region from metadata: %w\", err)\n\t}\n\n\treturn metadataRegion.Region, nil\n}\n\nfunc VFSPath(url string) (string, error) {\n\tif !s3UrlRegexp.MatchString(url) {\n\t\treturn \"\", fmt.Errorf(\"%s is not a valid S3 URL\", url)\n\t}\n\tgroupNames := s3UrlRegexp.SubexpNames()\n\tresult := s3UrlRegexp.FindAllStringSubmatch(url, -1)[0]","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/s3context.go#L331-L367","documentation":"getRegionFromMetadata loads an AWS SDK v2 config (to then query EC2 IMDS for the current region) with a 100ms HTTP client. If awsconfig.LoadDefaultConfig itself returns an error — typically invalid shared config/credentials files or a malformed profile — this error wraps it. It occurs while kOps tries to infer the region for a state-store bucket by asking the local instance metadata service.","triggerScenarios":"awsconfig.LoadDefaultConfig fails while resolving the config chain during getDetailsForBucket: malformed ~/.aws/config or ~/.aws/credentials (bad INI syntax), a referenced source_profile or role_arn that cannot be assumed, invalid IMDS client configuration options, or an invalid AWS_SDK_LOAD_CONFIG environment setup. Raised only when kops is running on EC2 (isRunningOnEC2 detected EC2 product_uuid) and the bucket region was not already resolvable.","commonSituations":"Hand-edited ~/.aws/config with syntax errors; profile with role_arn whose trust policy doesn't allow the caller; broken credential_process output; AWS_CONFIG_FILE pointing at a nonexistent/corrupt file; SDK v2 config options conflicting (e.g. bad retry/endpoint settings injected via env).","solutions":["Inspect the wrapped message after 'failed to load AWS config:' — it names the offending file/profile; fix the syntax or reference","Run aws configure list / AWS_PROFILE=<profile> aws sts get-caller-identity to validate the profile resolves correctly","Fix role_arn/source_profile entries so the caller is in the trust policy and can assume the role","Point AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE at valid files, or unset them if stale","If region inference keeps failing, bypass metadata inference: set AWS_REGION explicitly or store cluster state with a fully qualified s3://bucket that kOps can resolve via HeadBucket"],"exampleFix":"// before: broken ~/.aws/config\n[profile kops]\nrole_arn = arn:aws:iam::123:role/Kops\n// missing source_profile → config load/credential resolution fails\n// after\n[profile kops]\nrole_arn = arn:aws:iam::123:role/Kops\nsource_profile = default","handlingStrategy":"validation","validationCode":"// Validate the AWS config resolves before running kops\naws configure list >/dev/null 2>&1 || { echo \"invalid AWS config files\"; exit 1; }\nAWS_PROFILE=${AWS_PROFILE:-default} aws sts get-caller-identity >/dev/null || { echo \"profile cannot authenticate\"; exit 1; }","typeGuard":"func isAWSConfigLoadError(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"failed to load AWS config\")\n}","tryCatchPattern":null,"preventionTips":["Keep ~/.aws/config and ~/.aws/credentials valid INI; validate with `aws configure list` after edits","Ensure every role_arn has a resolvable source_profile and that the caller is in the role's trust policy","Avoid stale AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE overrides; unset if unused","Test `aws sts get-caller-identity` with the intended profile before running kops","Set AWS_REGION explicitly so region inference via IMDS (this code path) is avoided"],"tags":["aws","configuration","ec2-imds","credentials"],"backgroundTag":"aws-config-load-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}