kubernetes/kops · error

error starting a new AWS session: %v

Error message

error starting a new AWS session: %v

What it means

After loading the SDK config, ValidateRegion creates an EC2 client; this error wraps a failure reported while establishing the AWS session/client setup for the region check. In practice it indicates the session could not be started with the given configuration — typically a credential or region resolution problem at session-creation time. It is a legacy-path message kept alongside the config-loading error in the same function.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:64

func ValidateRegion(ctx context.Context, region string) error {
	allRegionsMutex.Lock()
	defer allRegionsMutex.Unlock()

	if allRegions == nil {
		klog.V(2).Infof("Querying EC2 for all valid regions")

		request := &ec2.DescribeRegionsInput{}
		awsRegion := os.Getenv("AWS_REGION")
		if awsRegion == "" {
			awsRegion = "us-east-1"
		}
		cfg, err := loadAWSConfig(ctx, awsRegion)
		if err != nil {
			return fmt.Errorf("error loading AWS config: %v", err)
		}

		if err != nil {
			return fmt.Errorf("error starting a new AWS session: %v", err)
		}

		client := ec2.NewFromConfig(cfg)

		response, err := client.DescribeRegions(ctx, request)
		if err != nil {
			return fmt.Errorf("got an error while querying for valid regions (verify your AWS credentials?): %v", err)
		}
		allRegions = response.Regions
	}

	for _, r := range allRegions {
		name := aws.ToString(r.RegionName)
		if name == region {
			return nil
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Refresh credentials (aws sso login, re-run credential_process, or rotate keys)
2. Verify the region string is well-formed (e.g. us-east-1) before validation
3. Retry after fixing the AWS environment; check AWS_STS regional endpoints if assume-role is involved

Example fix

// before
kops create cluster --region us-gov-west-1 ...  # with standard partition credentials
// after
kops create cluster --region us-east-1 ...       # region matching your credentials' partition

// ensure region is syntactically valid first
func validRegionFormat(r string) bool {
    re := regexp.MustCompile(`^[a-z]{2}(-gov)?-[a-z]+-\d$`)
    return re.MatchString(r)
}

err := kopsValidateRegion(ctx, region)
if err != nil {
    if isTransient(err) { // throttling/timeout
        time.Sleep(backoff); err = kopsValidateRegion(ctx, region)
    }
    return err
}

When it happens

Trigger: ValidateRegion (via BuildCloud or tests) reaching the session-creation branch when an underlying session/credential setup call returns a non-nil error for the chosen awsRegion.

Common situations: Credentials resolved but invalid/expired (SSO token stale), assume-role failures, or misconfigured region passed down so the SDK cannot build a valid client.

Related errors

• error loading default AWS config: %v
• error initializing AWS client: %v
• failed to load default aws config: %w
• failed to load aws config: %w
• getting AWS credentials: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a5bfd6a85bf47c4d. Report an issue: GitHub.