{"record":{"id":"efb9fb21d9666534","repo":"kubernetes/kops","slug":"failed-to-load-default-aws-config-w-efb9fb","errorCode":null,"errorMessage":"failed to load default aws config: %w","messagePattern":"failed to load default aws config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":60,"sourceCode":"\ntype awsAuthenticator struct {\n\t// sts holds the AWS STS client, for signing V2 requests\n\tsts *sts.Client\n\n\t// region holds the AWS region in which we are running\n\tregion string\n\n\t// credentialsProvider returns our AWS credentials, for sigining V1 requests\n\tcredentialsProvider aws.CredentialsProvider\n}\n\nvar _ bootstrap.Authenticator = (*awsAuthenticator)(nil)\n\n// RegionFromMetadata returns the current region from the aws metdata\nfunc RegionFromMetadata(ctx context.Context) (string, error) {\n\tcfg, err := awsconfig.LoadDefaultConfig(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to load default aws config: %w\", err)\n\t}\n\tmetadata := imds.NewFromConfig(cfg)\n\n\tresp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get region from ec2 metadata: %w\", err)\n\t}\n\treturn resp.Region, nil\n}\n\nfunc NewAWSAuthenticator(ctx context.Context, region string) (bootstrap.Authenticator, error) {\n\tconfig, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load aws config: %w\", err)\n\t}\n\treturn &awsAuthenticator{\n\t\tcredentialsProvider: config.Credentials,\n\t\tregion:              region,","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L42-L78","documentation":"RegionFromMetadata in pkg/bootstrap/awsbootstrap loads a default AWS SDK v2 config (credential/config chain) in order to create an IMDS client. If awsconfig.LoadDefaultConfig fails - which is unusual because loading itself defers most errors, but can fail on malformed shared config files or bad environment - the error is wrapped and returned. This runs on nodes bootstrapping via the AWS bootstrap authenticator.","triggerScenarios":"Calling RegionFromMetadata(ctx) on a machine where the AWS config-loading chain fails: corrupted or syntactically invalid ~/.aws/config or ~/.aws/credentials, malformed AWS_SDK_LOAD_CONFIG content, or invalid profile references (source_profile pointing to a missing profile).","commonSituations":"Running kops/node tooling on a workstation with a hand-edited AWS shared config containing syntax errors; a broken AWS_PROFILE referencing a nonexistent profile; bad values in AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE env vars.","solutions":["Fix the AWS shared config/credentials files: run `aws sts get-caller-identity` to reproduce, and correct syntax errors in ~/.aws/config or the file named by AWS_CONFIG_FILE.","Unset or fix AWS_PROFILE, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE env vars pointing at bad files.","If no local config is wanted, run on an EC2 instance relying on IMDS with no broken shared config, or pass an explicit region-based config instead of RegionFromMetadata."],"exampleFix":"// before (shell env on the host)\nAWS_PROFILE=nonexistent-profile\n// after\nunset AWS_PROFILE  # or set AWS_PROFILE=default with a valid profile in ~/.aws/config","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"region, err := awsbootstrap.RegionFromMetadata(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to load default aws config\") {\n        // fall back to explicit region from flag/env instead of config chain\n        region = os.Getenv(\"AWS_REGION\")\n    }\n    return fmt.Errorf(\"resolving region: %w\", err)\n}","preventionTips":["Keep ~/.aws/config and ~/.aws/credentials syntactically valid; verify with `aws configure list`.","Avoid setting AWS_PROFILE to profiles that do not exist; script env setup defensively.","On EC2, prefer IMDS/instance roles and clear stray shared-config env vars (AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE)."],"tags":["go","aws","aws-sdk-go-v2","config-load","bootstrap"],"backgroundTag":"aws-config-load-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}