{"record":{"id":"fb42ebb44f0e09e3","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-obtain-instance-role-credentials-w","errorCode":null,"errorMessage":"cannot obtain instance role credentials: %w","messagePattern":"cannot obtain instance role credentials: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/awsapi/config.go","lineNumber":270,"sourceCode":"\t\t\t}\n\t\t\tcredProfile = sourceProfile\n\t\t}\n\t\tif roleARN == \"\" {\n\t\t\troleARN = profileRoleARN\n\t\t}\n\t\tac, err := readSharedCredentials(credProfile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"cannot read shared credentials for profile %q: %w\", credProfile, err)\n\t\t}\n\t\tif ac == nil {\n\t\t\treturn nil, fmt.Errorf(\"missing credentials for profile %q\", credProfile)\n\t\t}\n\t\tacNew = ac\n\tdefault:\n\t\t// we need instance credentials if we do not have access keys\n\t\tac, err := getInstanceRoleCredentials(cfg.client)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"cannot obtain instance role credentials: %w\", err)\n\t\t}\n\t\tacNew = ac\n\t}\n\t// read credentials from sts api, if role_arn is defined\n\tif len(roleARN) > 0 {\n\t\tac, err := cfg.getRoleARNCredentials(acNew, roleARN)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"cannot get credentials for role_arn %q: %w\", roleARN, err)\n\t\t}\n\t\tacNew = ac\n\t}\n\tif len(acNew.AccessKeyID) == 0 {\n\t\treturn nil, fmt.Errorf(\"missing AWS access_key; it may be set via env var AWS_ACCESS_KEY_ID or use instance iam role\")\n\t}\n\tif len(acNew.SecretAccessKey) == 0 {\n\t\treturn nil, fmt.Errorf(\"missing AWS secret_key; it may be set via env var AWS_SECRET_ACCESS_KEY or use instance iam role\")\n\t}\n\treturn acNew, nil","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/awsapi/config.go#L252-L288","documentation":"Fires in getAPICredentials default branch when getInstanceRoleCredentials fails — no access keys, web token, container URI, or profile matched, so the code falls back to EC2 instance metadata (IMDS) and that call errored. Usually means IMDS is unreachable, throttled, or the instance has no attached IAM role.","triggerScenarios":"Thrown at lib/awsapi/config.go:270 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Attach an IAM instance profile role to the EC2 instance","Verify IMDS is reachable (check IMDSv2 token TTL/hop limits, firewall rules blocking 169.254.169.254)","Alternatively configure explicit access keys or a profile instead of relying on the instance role"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}