{"record":{"id":"e49eef0b7afe46a9","repo":"JuliusBrussee/caveman","slug":"awssig-signer-requires-region-and-service","errorCode":null,"errorMessage":"awssig: signer requires region and service","messagePattern":"awssig: signer requires region and service","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/awssig/awssig.go","lineNumber":67,"sourceCode":"type Signer struct {\n\tRegion  string\n\tService string\n}\n\n// Sign computes the SigV4 signature for req against the given payload and sets\n// the Authorization, X-Amz-Date, X-Amz-Content-Sha256 (and, when present,\n// X-Amz-Security-Token) headers on req. The Host header is derived from req.URL.\n//\n// payloadHash is the lowercase hex SHA-256 of the request body; pass\n// HashPayload(body) for the common case, or UnsignedPayload() for streaming\n// bodies that must not be buffered. now fixes the signing instant (use\n// time.Now().UTC()); it is a parameter so tests are deterministic.\n//\n// Sign returns an error only for malformed inputs (no region/service, missing\n// credentials, unparseable URL). It never returns the secret in the error.\nfunc (s Signer) Sign(req *http.Request, creds Credentials, payloadHash string, now time.Time) error {\n\tif s.Region == \"\" || s.Service == \"\" {\n\t\treturn fmt.Errorf(\"awssig: signer requires region and service\")\n\t}\n\tif !creds.Valid() {\n\t\treturn fmt.Errorf(\"awssig: incomplete AWS credentials\")\n\t}\n\tif req.URL == nil {\n\t\treturn fmt.Errorf(\"awssig: request has no URL\")\n\t}\n\tnow = now.UTC()\n\tamzDate := now.Format(\"20060102T150405Z\")\n\tdateStamp := now.Format(\"20060102\")\n\n\thost := req.URL.Host\n\tif req.Host != \"\" {\n\t\thost = req.Host\n\t}\n\treq.Header.Set(\"Host\", host)\n\treq.Header.Set(\"X-Amz-Date\", amzDate)\n\treq.Header.Set(\"X-Amz-Content-Sha256\", payloadHash)","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/awssig/awssig.go#L49-L85","documentation":"Sign was called on a Signer whose Region or Service field is empty, so a SigV4 credential scope cannot be built. It is a constructor/configuration error: the signer must be instantiated with both an AWS region and service name before any request can be signed.","triggerScenarios":"Thrown at shared/platform/awssig/awssig.go:67 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set both Region (e.g. us-east-1) and Service (e.g. bedrock) on the Signer","Load the region from AWS configuration/endpoint ARN rather than hardcoding"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}