kubernetes/kops · error

error initializing AWS client: %v

Error message

error initializing AWS client: %v

What it means

RunToolboxInstanceSelector wraps any failure from awsup.NewAWSCloud, which builds the AWS SDK client for the cluster's region using the KubernetesCluster tag. NewAWSCloud validates the region and performs region discovery; any SDK init failure (invalid region, missing/bad credentials, network issues) is surfaced here. This error means kOps could not construct a working AWS client before doing any instance-selector work.

Source

Thrown at cmd/kops/toolbox_instance-selector.go:271

	if commandline.Flags[subnets] != nil {
		userSubnets := *commandline.StringSliceMe(commandline.Flags[subnets])
		dryRun := *commandline.BoolMe(commandline.Flags[dryRun])
		err := validateUserSubnets(userSubnets, cluster.Spec.Networking.Subnets)
		if err != nil && !dryRun {
			return err
		}
		igSubnets = userSubnets
	}

	zones := []string{}
	for _, igSubnet := range igSubnets {
		zones = append(zones, strings.ReplaceAll(igSubnet, "utility-", ""))
	}

	tags := map[string]string{"KubernetesCluster": options.ClusterName}
	cloud, err := awsup.NewAWSCloud(region, tags)
	if err != nil {
		return fmt.Errorf("error initializing AWS client: %v", err)
	}

	instanceSelector, err := selector.New(ctx, cloud.Config())
	if err != nil {
		return fmt.Errorf("error initializing instance selector: %v", err)
	}
	igCount := options.InstanceGroupCount
	filters := getFilters(commandline, region, zones)
	mutatedFilters := filters
	if commandline.Flags[instanceGroupCount] != nil || filters.Flexible != nil {
		if filters.VCpusToMemoryRatio == nil {
			defaultStartRatio := float64(2.0)
			mutatedFilters.VCpusToMemoryRatio = &defaultStartRatio
		}
	}

	newInstanceGroups := []*kops.InstanceGroup{}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the --region value is a valid AWS region code (e.g. us-east-1), not an availability zone.
2. Check AWS credentials: run `aws sts get-caller-identity` to confirm auth works in this shell.
3. Ensure AWS_REGION/AWS_DEFAULT_REGION or the shared config file is consistent with the flag.
4. If behind a proxy/airgap, confirm EC2 endpoints for the region are reachable.

Example fix

// before
kops toolbox instance-selector --region us-east-1a ...
// after
kops toolbox instance-selector --region us-east-1 ...

region := "us-east-1"
if region == "" || len(strings.Split(region, "-")) != 3 || strings.Contains(region, "az") {
	return fmt.Errorf("invalid AWS region %q", region)
}
// also verify credentials beforehand:
// aws sts get-caller-identity

if _, err := awsup.NewAWSCloud(region, tags); err != nil {
	log.Fatalf("AWS client init failed: %v — check --region and AWS credentials", err)
}

When it happens

Trigger: awsup.NewAWSCloud(region, tags) returns an error: region string is invalid/empty, AWS credentials cannot be resolved (env, shared config, IAM role), or the EC2 metadata/region validation call fails.

Common situations: Passing a mistyped --region like us-east-1a or eu-west; running outside AWS without AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY set or ~/.aws/credentials absent; expired SSO session; corporate proxy blocking EC2 endpoints.

Related errors

• DeviceName not set for volume
• error populating configuration: %v
• error initializing AWS client: %v
• error populating configuration: %w
• building presigned request: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4a43ab7be56d12fc. Report an issue: GitHub.