getsops/sops · error

unable to load SDK config: %w

Error message

unable to load SDK config: %w

What it means

S3Destination.Upload calls the AWS SDK v2 config.LoadDefaultConfig to build credentials/region settings, and this error wraps any failure of that load. The library throws it because without a valid SDK config it cannot construct the S3 client.

Source

Thrown at publish/s3.go:34

	s3Bucket string
	s3Prefix string
}

// NewS3Destination is the constructor for an S3 Destination
func NewS3Destination(s3Bucket, s3Prefix string) *S3Destination {
	return &S3Destination{s3Bucket, s3Prefix}
}

// Path returns the S3 path of a file in an S3 Destination (bucket)
func (s3d *S3Destination) Path(fileName string) string {
	return fmt.Sprintf("s3://%s/%s%s", s3d.s3Bucket, s3d.s3Prefix, fileName)
}

// Upload uploads contents to a file in an S3 Destination (bucket)
func (s3d *S3Destination) Upload(fileContents []byte, fileName string) error {
	cfg, err := config.LoadDefaultConfig(context.TODO())
	if err != nil {
		return fmt.Errorf("unable to load SDK config: %w", err)
	}
	svc := s3.NewFromConfig(cfg)
	input := &s3.PutObjectInput{
		Body:   manager.ReadSeekCloser(bytes.NewReader(fileContents)),
		Bucket: aws.String(s3d.s3Bucket),
		Key:    aws.String(s3d.s3Prefix + fileName),
	}
	if _, err = svc.PutObject(context.TODO(), input); err != nil {
		return err
	}
	return nil
}

// Returns NotImplementedError
func (s3d *S3Destination) UploadUnencrypted(data map[string]interface{}, fileName string) error {
	return &NotImplementedError{"S3 does not support uploading the unencrypted file contents."}
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Ensure AWS credentials are present: AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (or attached IAM role) are set and readable.
2. Check ~/.aws/config and ~/.aws/credentials parse correctly and the referenced profile exists.
3. Set AWS_REGION or a default region in the config file.
4. Inspect the wrapped %w cause to pinpoint which source failed.

Example fix

// before (env)
AWS_PROFILE=no-such-profile app publish s3 ...
// after
export AWS_PROFILE=default
export AWS_REGION=us-east-1

if os.Getenv("AWS_ACCESS_KEY_ID") == "" && os.Getenv("AWS_PROFILE") == "" {
    if _, err := os.Stat(filepath.Join(homedir, ".aws", "credentials")); err != nil {
        return fmt.Errorf("no AWS credentials configured")
    }
}

err := dest.Upload(data, name)
if err != nil && strings.Contains(err.Error(), "unable to load SDK config") {
    return fmt.Errorf("check AWS env/credentials: %w", err)
}

When it happens

Trigger: Calling S3Destination.Upload(fileContents, fileName) when LoadDefaultConfig fails — e.g. malformed AWS_* environment variables, unreadable shared credentials/config files, or an invalid profile name.

Common situations: Missing AWS credentials in CI containers, typo'd AWS_PROFILE, malformed ~/.aws/config, stale or invalid ~/.aws/credentials, or a bad AWS_SDK_LOAD_CONFIG setup.

Related errors

• failed to construct Azure Key Vault client to decrypt data:
• config file not found
• invalid %s key configuration: expected string in list, got %
• invalid %s key configuration: expected string, []string, or
• Could not unmarshal config file: %s

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/4264e77719b14ef6. Report an issue: GitHub.