{"record":{"id":"e558fd4679b57732","repo":"temporalio/temporal","slug":"unable-to-resolve-aws-region-for-obtaining-aws-ela","errorCode":null,"errorMessage":"unable to resolve AWS region for obtaining AWS Elastic signing credentials","messagePattern":"unable to resolve AWS region for obtaining AWS Elastic signing credentials","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/persistence/visibility/store/elasticsearch/client/aws.go","lineNumber":65,"sourceCode":"\t}\n\n\tif bodyBytes != nil {\n\t\t// set the request body just in case the signer consumes the body\n\t\treq.Body = io.NopCloser(bytes.NewReader(bodyBytes))\n\t}\n\n\treturn t.wrapped.RoundTrip(req)\n}\n\nfunc NewAwsHttpClient(config ESAWSRequestSigningConfig) (*http.Client, error) {\n\tif !config.Enabled {\n\t\treturn nil, nil\n\t}\n\n\tif config.Region == \"\" {\n\t\tconfig.Region = os.Getenv(\"AWS_REGION\")\n\t\tif config.Region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"unable to resolve AWS region for obtaining AWS Elastic signing credentials\")\n\t\t}\n\t}\n\n\tvar credsProvider aws.CredentialsProvider\n\n\tswitch strings.ToLower(config.CredentialProvider) {\n\tcase \"static\":\n\t\tcredsProvider = credentials.NewStaticCredentialsProvider(\n\t\t\tconfig.Static.AccessKeyID,\n\t\t\tconfig.Static.SecretAccessKey,\n\t\t\tconfig.Static.Token,\n\t\t)\n\tcase \"environment\":\n\t\tenvConfig, err := awsconfig.NewEnvConfig()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tcredsProvider = credentials.NewStaticCredentialsProvider(","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/persistence/visibility/store/elasticsearch/client/aws.go#L47-L83","documentation":"NewAwsHttpClient builds the signing HTTP client for AWS OpenSearch/Elasticsearch visibility stores. SigV4 signing requires a region; if ESAWSRequestSigningConfig.Region is empty it falls back to the AWS_REGION environment variable, and when both are empty it refuses to construct the client with this error at visibility-store initialization time (via NewVisibilityStore).","triggerScenarios":"Visibility persistence config enables ES AWS request signing (enabled: true) but omits the region field, and the process environment has no AWS_REGION set (note AWS_DEFAULT_REGION is NOT checked) — the error surfaces during NewVisibilityStore at service startup.","commonSituations":"Deploying Temporal with AWS-managed OpenSearch where the operator set credentials but forgot the region in the visibility store config; containers launched with only AWS_DEFAULT_REGION set instead of AWS_REGION; region dropped when templating config across environments.","solutions":["Set the region in the visibility persistence config under the ES AWS request signing section","Export AWS_REGION in the service's environment if you prefer env-based configuration (AWS_DEFAULT_REGION is not consulted here)","Verify the rendered config template actually includes the region for this cluster/environment","Restart the frontend/history/worker services after adding the region — this error is fatal at store construction"],"exampleFix":"// before (persistence config)\nvisibilityStore:\n  esaws:\n    enabled: true\n    credentialProvider: aws-sdk-default\n// after\nvisibilityStore:\n  esaws:\n    enabled: true\n    region: \"us-west-2\"\n    credentialProvider: aws-sdk-default","handlingStrategy":"validation","validationCode":"// startup-time pre-check\nif cfg.Visibility.ESAWSRequestSigning.Enabled && cfg.Visibility.ESAWSRequestSigning.Region == \"\" && os.Getenv(\"AWS_REGION\") == \"\" {\n    return fmt.Errorf(\"AWS_REGION env or esaws.region config required for AWS ES signing\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set region explicitly in the visibility store config rather than relying on env","Remember only AWS_REGION is checked — do not rely on AWS_DEFAULT_REGION alone","Add config validation to your deployment pipeline (rendered config lint)","Include the region in Helm/config templates per environment"],"tags":["go","aws","elasticsearch","configuration","missing-env-var","visibility-store"],"backgroundTag":"missing-aws-region","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}