benbjohnson/litestream · error

s3: cannot load aws config: %w

Error message

s3: cannot load aws config: %w

What it means

config.LoadDefaultConfig failed while building the AWS session in Init. The SDK could not assemble a usable configuration — broken shared config/profile files, invalid IMDS/EKS metadata responses, or missing dependencies for the configured credential source.

Source

Thrown at s3/replica_client.go:445

	// - Web Identity Token credentials (for EKS)
	if c.AccessKeyID != "" && c.SecretAccessKey != "" {
		configOpts = append(configOpts, config.WithCredentialsProvider(
			credentials.NewStaticCredentialsProvider(c.AccessKeyID, c.SecretAccessKey, ""),
		))
	}

	// Enable AWS SDK debug logging if LITESTREAM_S3_DEBUG is set.
	// Useful for debugging S3-compatible providers (signing issues, request/response bodies).
	// Supports comma-separated values: signing,request,retries
	// Values: signing, request, request-with-body, response, response-with-body, retries, all
	if logMode := parseS3DebugEnv(); logMode != 0 {
		configOpts = append(configOpts, config.WithClientLogMode(logMode))
	}

	// Load AWS configuration
	cfg, err := config.LoadDefaultConfig(ctx, configOpts...)
	if err != nil {
		return fmt.Errorf("s3: cannot load aws config: %w", err)
	}

	// Create S3 client options
	s3Opts := []func(*s3.Options){
		func(o *s3.Options) {
			o.UsePathStyle = c.ForcePathStyle
			o.UseARNRegion = true
			// Add User-Agent and optional middleware.
			o.APIOptions = append(o.APIOptions, c.middlewareOption())
		},
	}

	// S3-compatible providers (Tigris, Backblaze B2, MinIO, Filebase, etc.) don't
	// support aws-chunked content encoding used by default checksum calculation
	// in AWS SDK Go v2 v1.73.0+. Disable automatic checksum calculation and
	// response checksum validation for all custom endpoints.
	// See: https://github.com/benbjohnson/litestream/issues/918
	// See: https://github.com/benbjohnson/litestream/issues/947

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Check ~/.aws/config and credentials files for syntax errors
2. Verify the AWS_PROFILE env var points to an existing profile
3. Provide static access-key-id/secret-access-key to bypass the chain

When it happens

Trigger: Thrown at s3/replica_client.go:445 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/19f5d9b8b427f459. Report an issue: GitHub.