grafana/k6 · error

sigv4 seems to be partially configured. All of K6_PROMETHEUS

Error message

sigv4 seems to be partially configured. All of K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY must all be set. Unset all to bypass sigv4

What it means

Thrown by the Prometheus remote-write output's config loader when the three sigv4 fields (region, access key, secret key) are neither all set nor all unset — isSigV4PartiallyConfigured treats a null.String as set only when Valid and non-blank. AWS SigV4 signing requires the complete triplet, so a partial set is rejected rather than silently sending unsigned or half-signed requests.

Source

Thrown at internal/output/prometheusrw/remotewrite/config.go:141

	if conf.TLSMinVersion.Valid && conf.TLSMinVersion.String == "1.2" {
		tlsMinVersion = tls.VersionTLS12
	}

	hc.TLSConfig = &tls.Config{
		InsecureSkipVerify: conf.InsecureSkipTLSVerify.Bool, //nolint:gosec
		MinVersion:         tlsMinVersion,
	}

	if conf.ClientCertificate.Valid && conf.ClientCertificateKey.Valid {
		cert, err := tls.LoadX509KeyPair(conf.ClientCertificate.String, conf.ClientCertificateKey.String)
		if err != nil {
			return nil, fmt.Errorf("failed to load the TLS certificate: %w", err)
		}
		hc.TLSConfig.Certificates = []tls.Certificate{cert}
	}

	if isSigV4PartiallyConfigured(conf.SigV4Region, conf.SigV4AccessKey, conf.SigV4SecretKey) {
		return nil, errors.New(
			"sigv4 seems to be partially configured. All of " +
				"K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY " +
				"must all be set. Unset all to bypass sigv4",
		)
	}

	if conf.SigV4Region.Valid && conf.SigV4AccessKey.Valid && conf.SigV4SecretKey.Valid {
		hc.SigV4 = &sigv4.Config{
			Region:             conf.SigV4Region.String,
			AwsAccessKeyID:     conf.SigV4AccessKey.String,
			AwsSecretAccessKey: conf.SigV4SecretKey.String,
		}
	}

	if len(conf.Headers) > 0 {
		hc.Headers = make(http.Header)
		for k, v := range conf.Headers {
			hc.Headers.Add(k, v)

View on GitHub (pinned to 93accf6570)

Solutions

1. Set all three: K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY
2. If SigV4 is not wanted, unset all three env vars to send unsigned remote-write requests
3. Print which of the three are non-empty in your runner before k6 starts (without leaking values) to find the missing one

Example fix

# before
export K6_PROMETHEUS_RW_SIGV4_REGION=us-east-1
export K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY=AKIA...
# secret key missing -> error

# after
export K6_PROMETHEUS_RW_SIGV4_REGION=us-east-1
export K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY=AKIA...
export K6_PROMETHEUS_RW_SIGV4_SECRET_KEY=...

# or bypass sigv4 entirely:
unset K6_PROMETHEUS_RW_SIGV4_REGION K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY K6_PROMETHEUS_RW_SIGV4_SECRET_KEY

SIGV4_VARS=(K6_PROMETHEUS_RW_SIGV4_REGION K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY K6_PROMETHEUS_RW_SIGV4_SECRET_KEY)
set_count=0
for v in "${SIGV4_VARS[@]}"; do [ -n "${!v:-}" ] && set_count=$((set_count+1)); done
[ "$set_count" -eq 0 ] || [ "$set_count" -eq 3 ] || { echo "sigv4 requires all three vars set or none; got $set_count"; exit 1; }

When it happens

Trigger: Setting K6_PROMETHEUS_RW_SIGV4_REGION but not the access/secret keys; exporting K6_PROMETHEUS_RW_SIGV4_SECRET_KEY from a secret store while the other two come from a different, failed source; a variable expanding to empty string in CI (which still counts as unset here but combined with others set elsewhere); JSON config with only some sigv4 fields.

Common situations: CI pipelines where the secret key is injected by a vault but the region was hardcoded in only one job; splitting config across multiple env files where one is not sourced; renaming variables (e.g. K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY vs ..._ACCESS_KEY_ID) so one is silently missing.

Related errors

• sigV4 config `Region`, `AwsAccessKeyID`, `AwsSecretAccessKey
• both K6_CLOUD_METRICS_PUSH_URL and K6_CLOUD_TEST_RUN_TOKEN m
• invalid size
• unsupported public key algorithm
• new SharedArray must be called in the init context

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/712199c60bd4202f. Report an issue: GitHub.