kubernetes/kops · error

error loading AWS config: %v

Error message

error loading AWS config: %v

What it means

ValidateRegion loads an AWS SDK v2 config (via loadAWSConfig) to test whether a region is valid, and wraps any config-loading failure with this message. Config loading fails when the SDK cannot resolve credentials, profile, or region configuration from env vars, shared config files, or other sources. It is the first failure mode of the region-validation path before any EC2 call is made.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:60

var allRegions []ec2types.Region
var allRegionsMutex sync.Mutex

// ValidateRegion checks that an AWS region name is valid
func ValidateRegion(ctx context.Context, region string) error {
	allRegionsMutex.Lock()
	defer allRegionsMutex.Unlock()

	if allRegions == nil {
		klog.V(2).Infof("Querying EC2 for all valid regions")

		request := &ec2.DescribeRegionsInput{}
		awsRegion := os.Getenv("AWS_REGION")
		if awsRegion == "" {
			awsRegion = "us-east-1"
		}
		cfg, err := loadAWSConfig(ctx, awsRegion)
		if err != nil {
			return fmt.Errorf("error loading AWS config: %v", err)
		}

		if err != nil {
			return fmt.Errorf("error starting a new AWS session: %v", err)
		}

		client := ec2.NewFromConfig(cfg)

		response, err := client.DescribeRegions(ctx, request)
		if err != nil {
			return fmt.Errorf("got an error while querying for valid regions (verify your AWS credentials?): %v", err)
		}
		allRegions = response.Regions
	}

	for _, r := range allRegions {
		name := aws.ToString(r.RegionName)
		if name == region {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check ~/.aws/config and ~/.aws/credentials parse correctly (run `aws sts get-caller-identity` with the same environment)
2. Unset or fix AWS_PROFILE / AWS_CONFIG_FILE if they point to broken profiles
3. Provide valid credentials via env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or a proper credential source (SSO, instance role)
4. Update AWS SDK to ensure the config loader supports your SSO/config format

Example fix

// before
export AWS_PROFILE=no-such-profile
// after
export AWS_PROFILE=staging-admin  # profile that exists in ~/.aws/config

// fail fast with a clear message before calling kops
if os.Getenv("AWS_PROFILE") != "" {
    if _, err := os.Stat(filepath.Join(home, ".aws", "config")); err != nil {
        log.Fatalf("AWS_PROFILE set but no ~/.aws/config")
    }
}

if err := kopsValidateRegion(ctx, region); err != nil {
    if strings.Contains(err.Error(), "error loading AWS config") {
        log.Fatalf("fix AWS config/credentials: %v", err)
    }
    return err
}

When it happens

Trigger: Calling ValidateRegion (directly or via BuildCloud) when loadAWSConfig returns an error — e.g. malformed AWS_SDK_LOAD_CONFIG shared file, invalid profile name, unresolvable credential chain, or bad region format passed to config loading.

Common situations: AWS_CONFIG_FILE or ~/.aws/credentials is corrupt or has wrong permissions; AWS_PROFILE names a nonexistent profile; credential_process returns junk; running in CI without any AWS env configuration.

Related errors

• failed to load AWS config: %w
• error loading AWS config: %v
• error loading default AWS config: %v
• error initializing AWS client: %v
• failed to load default aws config for IMDS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a6e18f1bb792451d. Report an issue: GitHub.