{"record":{"id":"d379592b123cb5dc","repo":"openai/codex","slug":"aws-sdk-config-did-not-resolve-a-region","errorCode":null,"errorMessage":"AWS SDK config did not resolve a region","messagePattern":"AWS SDK config did not resolve a region","errorType":"exception","errorClass":"AwsAuthError","httpStatus":null,"severity":"error","filePath":"codex-rs/aws-auth/src/lib.rs","lineNumber":51,"sourceCode":"}\n\n/// Signed request parts returned to the caller.\n#[derive(Debug, Clone, PartialEq, Eq)]\npub struct AwsSignedRequest {\n    pub url: String,\n    pub headers: HeaderMap,\n}\n\n/// Errors returned by credential loading or SigV4 signing.\n#[derive(Debug, Error)]\npub enum AwsAuthError {\n    #[error(\"AWS service name must not be empty\")]\n    EmptyService,\n    #[error(\"AWS profile must be configured\")]\n    MissingProfile,\n    #[error(\"AWS SDK config did not resolve a credentials provider\")]\n    MissingCredentialsProvider,\n    #[error(\"AWS SDK config did not resolve a region\")]\n    MissingRegion,\n    #[error(\"failed to load AWS profiles: {0}\")]\n    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),\n    #[error(\"failed to load AWS credentials: {0}\")]\n    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),\n    #[error(\"request URL is not a valid URI: {0}\")]\n    InvalidUri(#[source] http::uri::InvalidUri),\n    #[error(\"failed to construct HTTP request for signing: {0}\")]\n    BuildHttpRequest(#[source] http::Error),\n    #[error(\"request contains a non-UTF8 header value: {0}\")]\n    InvalidHeaderValue(#[source] http::header::ToStrError),\n    #[error(\"failed to build signable request: {0}\")]\n    SigningRequest(#[source] aws_sigv4::http_request::SigningError),\n    #[error(\"failed to build SigV4 signing params: {0}\")]\n    SigningParams(String),\n    #[error(\"SigV4 signing failed: {0}\")]\n    SigningFailure(#[source] aws_sigv4::http_request::SigningError),\n}","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/aws-auth/src/lib.rs#L33-L69","documentation":"SigV4 requires a concrete region (it is part of the canonical request and the signing scope), so after loading the SDK config, AwsAuthContext::load calls resolved_region, which maps a None region to this error. It fires when AwsAuthConfig.region was not set and the SDK also found no region via AWS_REGION/AWS_DEFAULT_REGION or the active profile's 'region' key.","triggerScenarios":"AwsAuthConfig with region: None where neither AWS_REGION nor AWS_DEFAULT_REGION is exported and the active profile in ~/.aws/config has no region line; CI shells that strip environment variables.","commonSituations":"aws configure completed without answering the region prompt; profiles generated by tools that omit region; new integrations assuming region is optional (as it is for some AWS APIs) when SigV4 signing mandates it.","solutions":["Set AwsAuthConfig.region = Some(\"us-east-1\") explicitly at the call site","Or export AWS_REGION / AWS_DEFAULT_REGION in the environment","Or add 'region = <region>' under the named profile in ~/.aws/config"],"exampleFix":"// before\nlet ctx = AwsAuthContext::load(AwsAuthConfig {\n    profile: None, region: None, service: \"s3\".into(),\n}).await?; // MissingRegion\n\n// after\nlet ctx = AwsAuthContext::load(AwsAuthConfig {\n    profile: None, region: Some(\"us-east-1\".into()), service: \"s3\".into(),\n}).await?;","handlingStrategy":"validation","validationCode":"let region = config.region.clone()\n    .or_else(|| std::env::var(\"AWS_REGION\").ok())\n    .or_else(|| std::env::var(\"AWS_DEFAULT_REGION\").ok())\n    .ok_or(\"AWS region required for SigV4\");\nlet ctx = AwsAuthContext::load(AwsAuthConfig { region: region.ok(), ..config }).await?;","typeGuard":"fn is_missing_region(e: &AwsAuthError) -> bool {\n    matches!(e, AwsAuthError::MissingRegion)\n}","tryCatchPattern":"match AwsAuthContext::load(config).await {\n    Err(e @ AwsAuthError::MissingRegion) => return Err(config_error(e)), // fix config, do not retry\n    other => other?,\n}","preventionTips":["Always pass region explicitly when you have it - SigV4 mandates it","Set AWS_REGION in CI images or add region to each profile in ~/.aws/config","Treat Missing* AwsAuthError variants as configuration defects, never as transient failures"],"tags":["rust","aws","configuration","region","sigv4"],"backgroundTag":"aws-region-not-configured","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}