error querying for valid AZs in %q - verify your AWS credent

Error message

error querying for valid AZs in %q - verify your AWS credentials.  Error: %v

What it means

Returned by DescribeAvailabilityZones (aws_cloud.go:1799) when ec2.DescribeAvailabilityZones fails; the message explicitly hints to verify AWS credentials because the most common cause is authentication. The region is interpolated for context.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1799

		return WellKnownAccountFlatcar
	case "redhat", "redhat.com":
		return WellKnownAccountRedhat
	case "ubuntu":
		return WellKnownAccountUbuntu
	case "rocky", "rockylinux":
		return WellKnownAccountRockyLinux
	}
	return owner
}

func (c *awsCloudImplementation) DescribeAvailabilityZones() ([]ec2types.AvailabilityZone, error) {
	klog.V(2).Infof("Querying EC2 for all valid zones in region %q", c.region)
	ctx := context.TODO()

	request := &ec2.DescribeAvailabilityZonesInput{}
	response, err := c.EC2().DescribeAvailabilityZones(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error querying for valid AZs in %q - verify your AWS credentials.  Error: %v", c.region, err)
	}

	return response.AvailabilityZones, nil
}

// ValidateZones checks that every zone in the sliced passed is recognized
func ValidateZones(zones []string, cloud AWSCloud) error {
	azs, err := cloud.DescribeAvailabilityZones()
	if err != nil {
		return err
	}

	zoneMap := make(map[string]ec2types.AvailabilityZone)
	for _, z := range azs {
		name := aws.ToString(z.ZoneName)
		zoneMap[name] = z
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Run `aws ec2 describe-availability-zones --region <region>` with the same credentials to see the raw error
Refresh credentials: `aws sso login`, re-export keys, or fix the instance/profile role
Check the region value is a valid region ID, not an AZ name
Grant ec2:DescribeAvailabilityZones in the caller's IAM policy and verify network/proxy egress to ec2.<region>.amazonaws.com

Example fix

// before
export AWS_REGION=us-east-1a   # AZ, not region; expired keys
// after
aws sso login && export AWS_REGION=us-east-1

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-flight credential/region check before kops runs
sessCfg, err := config.LoadDefaultConfig(ctx)
if err != nil { return fmt.Errorf("no AWS config: %w", err) }
_, err = ec2.NewFromConfig(sessCfg).DescribeAvailabilityZones(ctx, &ec2.DescribeAvailabilityZonesInput{})
if err != nil { return fmt.Errorf("AWS credentials/region invalid: %w", err) }

Try / catch

zones, err := cloud.DescribeAvailabilityZones()
if err != nil {
	if strings.Contains(err.Error(), "AuthFailure") || strings.Contains(err.Error(), "ExpiredToken") {
		// prompt credential refresh (aws sso login / new keys) and retry
	}
	return err
}

Prevention

Run `aws sts get-caller-identity` before long kops operations to catch expired sessions early
Set AWS_REGION explicitly; never pass an AZ name as a region
Verify corporate proxy/firewall allows egress to ec2.<region>.amazonaws.com
Include EC2 Describe* read permissions in the automation role

When it happens

Trigger: c.EC2().DescribeAvailabilityZones errors due to invalid/expired credentials, no ec2:DescribeAvailabilityZones permission, network egress blocked, wrong region name, or STS token expiry on assumed roles.

Common situations: First EC2 call during `kops create cluster` with unset AWS_PROFILE; expired SSO/STS session; corporate proxy blocking EC2 endpoints; IAM policy missing EC2 read permissions; typo'd region like `us-east-1a` used as a region.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/56b98a4ddff2b41c. Report an issue: GitHub.