kubernetes/kops · error

error initializing AWS client: %v

Error message

error initializing AWS client: %v

What it means

In the --external delete path, kOps calls awsup.NewAWSCloud(region, tags) to build the AWS SDK client. If that initialization fails (bad region string, missing/invalid credentials, network issues fetching account info), the error is wrapped with this message.

Source

Thrown at cmd/kops/delete_cluster.go:124

	clusterName := options.ClusterName
	if clusterName == "" {
		return fmt.Errorf("--name is required (for safety)")
	}

	var cloud fi.Cloud
	var cluster *kopsapi.Cluster
	var err error

	if options.External {
		region := options.Region
		if region == "" {
			return fmt.Errorf("--region is required (when --external)")
		}

		tags := map[string]string{"KubernetesCluster": clusterName}
		cloud, err = awsup.NewAWSCloud(region, tags)
		if err != nil {
			return fmt.Errorf("error initializing AWS client: %v", err)
		}
	} else {
		cluster, err = GetCluster(ctx, f, clusterName)
		if err != nil {
			return err
		}
	}

	wouldDeleteCloudResources := false

	if !options.Unregister {
		if cloud == nil {
			cloud, err = cloudup.BuildCloud(cluster)
			if err != nil {
				return err
			}
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify AWS credentials are present and valid (aws sts get-caller-identity).
2. Check the --region value is a valid AWS region identifier.
3. Ensure network access to the EC2 endpoint (proxy/VPN settings) and that the credentials' IAM policy allows the needed EC2 read calls.

Example fix

// before
export AWS_REGION="us-east1"  # invalid
// after
export AWS_REGION="us-east-1"
aws sts get-caller-identity  # verify credentials before retrying

if os.Getenv("AWS_ACCESS_KEY_ID") == "" || os.Getenv("AWS_SECRET_ACCESS_KEY") == "" {
    return fmt.Errorf("AWS credentials must be configured (env, shared config, or instance profile)")
}
if !isValidAWSRegion(region) {
    return fmt.Errorf("invalid AWS region %q", region)
}

err := runDeleteCluster(...)
if err != nil && strings.Contains(err.Error(), "error initializing AWS client") {
    // check credentials/region/network, then retry once
}

When it happens

Trigger: awsup.NewAWSCloud returns an error: invalid region name, no AWS credentials found (env, shared config, instance profile), or inability to validate the account/zone against EC2 APIs.

Common situations: AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY not set or expired; `aws configure` never run; typo'd region (e.g. us-east-1a instead of us-east-1); IAM instance profile lacking EC2 permissions; corporate network blocking EC2 endpoints.

Related errors

• building presigned request: %w
• failed to load AWS config: %w
• DeviceName not set for volume
• error loading default AWS config: %v
• error populating configuration: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aeef8ae790ee90c3. Report an issue: GitHub.