kubernetes/kops · error

error from SignHTTP: %v

Error message

error from SignHTTP: %v

What it means

signV1Request wraps an error returned by the aws-sdk-go-v2 v4 signer's SignHTTP when signing the GetCallerIdentity request with the provided credentials, body hash, service (sts), and region. Signing is local computation but fails when credentials are empty/invalid or signing parameters (region, payload hash) are invalid.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:199

	// V1 requests use a well-known body (and host)
	body := []byte("Action=GetCallerIdentity&Version=2011-06-15")

	bodyHash := sha256.Sum256(body)

	signedRequest, err := http.NewRequest("POST", stsURL, bytes.NewReader(body))
	if err != nil {
		return nil, fmt.Errorf("building http request: %v", err)
	}
	signedRequest.Header.Add("Content-Type", "application/x-www-form-urlencoded; charset=utf-8")
	signedRequest.Header.Add("X-Kops-Request-Sha", kopsRequestHashBase64)

	signer := v4.NewSigner()

	service := "sts"

	if err := signer.SignHTTP(ctx, credentials, signedRequest, hex.EncodeToString(bodyHash[:]), service, region, signingTime); err != nil {
		return nil, fmt.Errorf("error from SignHTTP: %v", err)
	}

	return signedRequest, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify credentials are fully populated (AccessKeyID and SecretAccessKey non-empty) before signing.
2. Pass a valid AWS region string to the authenticator; avoid empty or placeholder regions.
3. Keep the signer module (aws/signer/v4) version aligned with other aws-sdk-go-v2 modules (`make gomod`).
4. Sync system clock (NTP) to avoid time-related signature rejection downstream.
5. Enable SDK client logging to capture the underlying wrapped error details.

Example fix

// before
if credentials.AccessKeyID == "" || credentials.SecretAccessKey == "" {
	// signer later fails inside SignHTTP
}
// after: validate before calling CreateToken
if credentials.AccessKeyID == "" || credentials.SecretAccessKey == "" {
	return fmt.Errorf("AWS credentials are incomplete; check env/profile")
}

creds, err := credProvider.Retrieve(ctx)
if err != nil || creds.AccessKeyID == "" || creds.SecretAccessKey == "" {
	return fmt.Errorf("cannot sign: incomplete AWS credentials")
}
if region == "" {
	return fmt.Errorf("cannot sign: empty region")
}

signed, err := signV1Request(ctx, stsURL, region, creds, time.Now(), body)
if err != nil {
	var opErr *smithy.OperationError
	if errors.As(err, &opErr) { /* inspect wrapped signer failure, fix creds/region, retry */ }
}

When it happens

Trigger: signer.SignHTTP(ctx, credentials, signedRequest, hex(bodyHash), "sts", region, signingTime) errors inside signV1Request, reached via createTokenV1 from CreateToken/TestAWSV1Request: empty AccessKeyID/SecretKey, invalid region characters, or signer internal failure.

Common situations: Credentials provider returned empty/blank values (partially populated env vars); region empty or with unsupported characters; mismatched aws-sdk-go-v2 signer version after dependency bump; system clock far off making signing parameters inconsistent in downstream verification.

Related errors

• building (v1) signed request: %w
• error loading default AWS config: %v
• error initializing AWS client: %v
• failed to load default aws config: %w
• failed to load aws config: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/026623b163015c99. Report an issue: GitHub.