kubernetes/kops · critical

error loading AWS config: %v

Error message

error loading AWS config: %v

What it means

The S3 VFS client builds an AWS SDK v2 config via config.LoadDefaultConfig when S3_ENDPOINT is unset. If credential/region resolution fails (no credentials found, invalid profile, etc.), getClient wraps the failure in 'error loading AWS config'.

Source

Thrown at util/pkg/vfs/s3context.go:107

	s.mutex.Lock()
	defer s.mutex.Unlock()

	if s3Client := s.clients[region]; s3Client != nil {
		return s3Client, nil
	}

	// Client configuration is determined by region and process-wide environment.
	// The first request for a region creates the shared client for that region.
	_, span := tracer.Start(ctx, "S3Context::getClient")
	defer span.End()

	var config aws.Config
	var err error
	endpoint := os.Getenv("S3_ENDPOINT")
	if endpoint == "" {
		config, err = awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))
		if err != nil {
			return nil, fmt.Errorf("error loading AWS config: %v", err)
		}
	} else {
		// Use customized S3 storage
		klog.V(2).Infof("Found S3_ENDPOINT=%q, using as non-AWS S3 backend", endpoint)
		config, err = getCustomS3Config(ctx, region)
		if err != nil {
			return nil, err
		}
	}

	s3Client := s3.NewFromConfig(config, optFn)

	s.clients[region] = s3Client

	return s3Client, nil
}

func getCustomS3Config(ctx context.Context, region string) (aws.Config, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure valid AWS credentials are available: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (or aws configure) and verify with 'aws sts get-caller-identity'
2. Set AWS_REGION or the region in your profile/config so LoadDefaultConfig resolves a region
3. Check AWS_PROFILE points to an existing profile and shared config files are readable
4. On EC2, verify the instance role and IMDS (169.254.169.254) are reachable
5. If targeting non-AWS S3, set S3_ENDPOINT (and S3_REGION/S3_ACCESS_KEY_ID etc.) to use the custom-config branch instead

Example fix

// before
export AWS_PROFILE=nope
kops get cluster --state s3://bucket // error loading AWS config
// after
export AWS_PROFILE=default AWS_REGION=us-east-1
aws sts get-caller-identity # verify, then retry kops

func awsConfigReady() error {
  if os.Getenv("AWS_ACCESS_KEY_ID") == "" {
    if _, err := os.Stat(filepath.Join(os.Getenv("HOME"), ".aws", "credentials")); err != nil {
      return errors.New("no AWS credentials found (env or ~/.aws/credentials)")
    }
  }
  if os.Getenv("AWS_REGION") == "" && os.Getenv("AWS_DEFAULT_REGION") == "" && os.Getenv("AWS_PROFILE") == "" {
    return errors.New("no AWS region resolvable; set AWS_REGION")
  }
  return nil
}

null

_, err := vfs.Context.ReadLocation(ctx, "s3://bucket/path")
if err != nil && strings.Contains(err.Error(), "error loading AWS config") {
    return fmt.Errorf("AWS credentials/region missing: %w; run aws configure or set AWS_REGION", err)
}

When it happens

Trigger: First use of an s3:// vfs path (getDetailsForBucket, client, hasServerSideEncryptionByDefault) when LoadDefaultConfig cannot resolve a region or credentials from env/shared config/IMDS.

Common situations: Running kops in an environment without AWS credentials (missing ~/.aws/credentials, no AWS_ACCESS_KEY_ID), an invalid AWS_PROFILE, no default region, or broken IMDS on EC2.

Related errors

• error loading AWS config: %v
• failed to load AWS config: %w
• error loading default AWS config: %v
• error initializing AWS client: %v
• failed to load default aws config for IMDS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6db8174e383baf50. Report an issue: GitHub.