getsops/sops · error

could not load AWS config: %w

Error message

could not load AWS config: %w

What it means

This error wraps a failure from AWS SDK's config.LoadDefaultConfig, which createKMSConfig calls to obtain aws.Config (credentials, region, HTTP client). If the SDK's default config chain fails (credential resolution errors, shared config file problems, invalid HTTP client wiring), sops wraps it with this message. The inner error tells the real cause.

Source

Thrown at kms/keysource.go:416

	region := matches[1]

	cfg, err := config.LoadDefaultConfig(ctx, func(lo *config.LoadOptions) error {
		// Use the credentialsProvider if present, otherwise default to reading credentials
		// from the environment.
		if key.credentialsProvider != nil {
			lo.Credentials = key.credentialsProvider
		}
		if key.AwsProfile != "" {
			lo.SharedConfigProfile = key.AwsProfile
		}
		lo.Region = region
		if key.httpClient != nil {
			lo.HTTPClient = key.httpClient
		}
		return nil
	})
	if err != nil {
		return nil, fmt.Errorf("could not load AWS config: %w", err)
	}

	if key.Role != "" {
		return key.createSTSConfig(ctx, &cfg)
	}
	return &cfg, nil
}

// createClient creates a new AWS KMS client with the provided config.
func (key MasterKey) createClient(config *aws.Config) *kms.Client {
	return kms.NewFromConfig(*config, func(o *kms.Options) {
		if key.baseEndpoint != "" {
			o.BaseEndpoint = aws.String(key.baseEndpoint)
		}
	})
}

// createSTSConfig uses AWS STS to assume a role and returns a config

View on GitHub (pinned to 13442bb981)

Solutions

1. Read the wrapped cause after 'could not load AWS config:' and fix the underlying AWS SDK config issue it names.
2. Run `aws sts get-caller-identity` with the same environment to confirm your credentials/config files are valid.
3. Check AWS_PROFILE, AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE point to existing, syntactically valid files.
4. If a custom httpClient was applied to the key, remove or fix it; otherwise let sops use the SDK default HTTP client.

Example fix

// before (broken profile)
export AWS_PROFILE=no-such-profile
// after
export AWS_PROFILE=default && aws sts get-caller-identity  # verify before running sops

// Go: probe AWS config chain before calling sops
import "github.com/aws/aws-sdk-go-v2/config"
func awsConfigOK(ctx context.Context) error {
  cfg, err := config.LoadDefaultConfig(ctx)
  if err != nil { return err }
  if cfg.Region == "" { return errors.New("no AWS region configured") }
  return nil
}

// Go
_, err := key.Encrypt()
if err != nil && strings.Contains(err.Error(), "could not load AWS config") {
  return fmt.Errorf("AWS setup invalid, run `aws sts get-caller-identity` to diagnose: %w", err)
}

When it happens

Trigger: EncryptContext/DecryptContext on a KMS MasterKey where LoadDefaultConfig fails: e.g. invalid AWS_SHARED_CREDENTIALS_FILE, malformed ~/.aws/config, a custom key.httpClient that cannot be used by the SDK, or credential_process failing.

Common situations: Broken ~/.aws/credentials syntax; AWS_PROFILE pointing to a nonexistent profile; misconfigured SSO/cache; running in CI without any credentials and a config file that forces credential lookup to fail; a custom HTTP client passed via ApplyToMasterKey that misbehaves.

Related errors

• no valid ARN found in '%s'
• cannot create GCP KMS service: %w
• failed to create HuaweiCloud KMS client: %w
• failed to assume role '%s': %w
• user config directory could not be determined: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/e13a6ca17bd87d79. Report an issue: GitHub.