kubernetes/kops · error

error connecting to S3: %s

Error message

error connecting to S3: %s

What it means

Returned by getDetailsForBucket when getClient fails to build an S3 client for the resolved region (defaults to us-east-1 when region detection finds nothing). The client construction failure — bad credentials, no region, or a broken custom endpoint config — is wrapped with this bucket-discovery context, so bucket region detection cannot proceed.

Source

Thrown at util/pkg/vfs/s3context.go:197

			if err != nil {
				klog.V(2).Infof("unable to get region from metadata:%v", err)
			} else {
				awsRegion = region
				klog.V(2).Infof("got region from metadata: %q", awsRegion)
			}
		}
	}

	if awsRegion == "" {
		awsRegion = "us-east-1"
		klog.V(2).Infof("defaulting region to %q", awsRegion)
	}

	s3Client, err := s.getClient(ctx, awsRegion, func(o *s3.Options) {
		o.EndpointResolverV2 = &ResolverV2{}
	})
	if err != nil {
		return bucketDetails, fmt.Errorf("error connecting to S3: %s", err)
	}
	// Attempt one GetBucketLocation call the "normal" way (i.e. as the bucket owner)
	response, err := s3Client.GetBucketLocation(ctx, &s3.GetBucketLocationInput{
		Bucket: &bucket,
	})

	if err != nil {
		// GetBucketLocation only works for the bucket owner from any region, or from the bucket's
		// region. Fall back to HeadBucket, which works cross-account and cross-region.
		klog.V(2).Infof("unable to get bucket location from region %q; falling back to HeadBucket: %v", awsRegion, err)
		bucketDetails.region, err = bucketLocationViaHead(ctx, s3Client, bucket)
		if err != nil {
			return bucketDetails, err
		}
	} else if len(response.LocationConstraint) == 0 {
		// US Classic does not return a region
		bucketDetails.region = "us-east-1"
	} else {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify AWS credentials are obtainable (env, profile, or instance metadata)
2. Set AWS_REGION/AWS_DEFAULT_REGION explicitly when metadata-service region detection fails or is blocked
3. If using S3_ENDPOINT, ensure S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY are both set

When it happens

Trigger: Thrown at util/pkg/vfs/s3context.go:197 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/106fb4967d9b37c3. Report an issue: GitHub.