{"record":{"id":"e13a6ca17bd87d79","repo":"getsops/sops","slug":"could-not-load-aws-config-w","errorCode":null,"errorMessage":"could not load AWS config: %w","messagePattern":"could not load AWS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kms/keysource.go","lineNumber":416,"sourceCode":"\tregion := matches[1]\n\n\tcfg, err := config.LoadDefaultConfig(ctx, func(lo *config.LoadOptions) error {\n\t\t// Use the credentialsProvider if present, otherwise default to reading credentials\n\t\t// from the environment.\n\t\tif key.credentialsProvider != nil {\n\t\t\tlo.Credentials = key.credentialsProvider\n\t\t}\n\t\tif key.AwsProfile != \"\" {\n\t\t\tlo.SharedConfigProfile = key.AwsProfile\n\t\t}\n\t\tlo.Region = region\n\t\tif key.httpClient != nil {\n\t\t\tlo.HTTPClient = key.httpClient\n\t\t}\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"could not load AWS config: %w\", err)\n\t}\n\n\tif key.Role != \"\" {\n\t\treturn key.createSTSConfig(ctx, &cfg)\n\t}\n\treturn &cfg, nil\n}\n\n// createClient creates a new AWS KMS client with the provided config.\nfunc (key MasterKey) createClient(config *aws.Config) *kms.Client {\n\treturn kms.NewFromConfig(*config, func(o *kms.Options) {\n\t\tif key.baseEndpoint != \"\" {\n\t\t\to.BaseEndpoint = aws.String(key.baseEndpoint)\n\t\t}\n\t})\n}\n\n// createSTSConfig uses AWS STS to assume a role and returns a config","sourceCodeStart":398,"sourceCodeEnd":434,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/kms/keysource.go#L398-L434","documentation":"This error wraps a failure from AWS SDK's config.LoadDefaultConfig, which createKMSConfig calls to obtain aws.Config (credentials, region, HTTP client). If the SDK's default config chain fails (credential resolution errors, shared config file problems, invalid HTTP client wiring), sops wraps it with this message. The inner error tells the real cause.","triggerScenarios":"EncryptContext/DecryptContext on a KMS MasterKey where LoadDefaultConfig fails: e.g. invalid AWS_SHARED_CREDENTIALS_FILE, malformed ~/.aws/config, a custom key.httpClient that cannot be used by the SDK, or credential_process failing.","commonSituations":"Broken ~/.aws/credentials syntax; AWS_PROFILE pointing to a nonexistent profile; misconfigured SSO/cache; running in CI without any credentials and a config file that forces credential lookup to fail; a custom HTTP client passed via ApplyToMasterKey that misbehaves.","solutions":["Read the wrapped cause after 'could not load AWS config:' and fix the underlying AWS SDK config issue it names.","Run `aws sts get-caller-identity` with the same environment to confirm your credentials/config files are valid.","Check AWS_PROFILE, AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE point to existing, syntactically valid files.","If a custom httpClient was applied to the key, remove or fix it; otherwise let sops use the SDK default HTTP client."],"exampleFix":"// before (broken profile)\nexport AWS_PROFILE=no-such-profile\n// after\nexport AWS_PROFILE=default && aws sts get-caller-identity  # verify before running sops","handlingStrategy":"validation","validationCode":"// Go: probe AWS config chain before calling sops\nimport \"github.com/aws/aws-sdk-go-v2/config\"\nfunc awsConfigOK(ctx context.Context) error {\n  cfg, err := config.LoadDefaultConfig(ctx)\n  if err != nil { return err }\n  if cfg.Region == \"\" { return errors.New(\"no AWS region configured\") }\n  return nil\n}","typeGuard":null,"tryCatchPattern":"// Go\n_, err := key.Encrypt()\nif err != nil && strings.Contains(err.Error(), \"could not load AWS config\") {\n  return fmt.Errorf(\"AWS setup invalid, run `aws sts get-caller-identity` to diagnose: %w\", err)\n}","preventionTips":["Verify credentials with `aws sts get-caller-identity` in the same shell before running sops","Pin AWS_PROFILE explicitly in scripts; do not rely on defaults","Keep ~/.aws/config and ~/.aws/credentials syntactically valid (parse with `aws configure list`)","Avoid custom httpClient overrides unless required; test them separately"],"tags":["aws","kms","config","credentials"],"backgroundTag":"aws-sdk-config-load-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}