kubernetes/kops · error

failed to get region from ec2 metadata: %w

Error message

failed to get region from ec2 metadata: %w

What it means

After loading the default config, RegionFromMetadata queries EC2 Instance Metadata Service (IMDS) GetRegion to discover the current region. If the IMDS request fails (unreachable endpoint, timeout, HTTP error, or empty/failed response), the SDK error is wrapped with this message. It means the code is not running where IMDS is available or IMDS is misconfigured/blocked.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:66

	region string

	// credentialsProvider returns our AWS credentials, for sigining V1 requests
	credentialsProvider aws.CredentialsProvider
}

var _ bootstrap.Authenticator = (*awsAuthenticator)(nil)

// RegionFromMetadata returns the current region from the aws metdata
func RegionFromMetadata(ctx context.Context) (string, error) {
	cfg, err := awsconfig.LoadDefaultConfig(ctx)
	if err != nil {
		return "", fmt.Errorf("failed to load default aws config: %w", err)
	}
	metadata := imds.NewFromConfig(cfg)

	resp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})
	if err != nil {
		return "", fmt.Errorf("failed to get region from ec2 metadata: %w", err)
	}
	return resp.Region, nil
}

func NewAWSAuthenticator(ctx context.Context, region string) (bootstrap.Authenticator, error) {
	config, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %w", err)
	}
	return &awsAuthenticator{
		credentialsProvider: config.Credentials,
		region:              region,
		sts:                 sts.NewFromConfig(config),
	}, nil
}

// awsV1Token is the format of the V1 request, it matches http.Header
type awsV1Token map[string][]string

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run the code on an EC2 instance with IMDS enabled; if running in a container on ECS/EC2, raise the IMDSv2 hop limit to 2 (aws ec2 modify-instance-metadata-options --http-put-response-hop-limit 2).
2. If IMDS is intentionally unavailable, avoid RegionFromMetadata and supply the region explicitly (e.g. NewAWSAuthenticator with a known region).
3. Check that 169.254.169.254 is reachable: curl -s http://169.254.169.254/latest/meta-data/placement/region; fix proxy/firewall rules that block link-local traffic.

Example fix

// before: region inferred from IMDS (fails off-EC2)
region, err := awsbootstrap.RegionFromMetadata(ctx)
// after: pass region explicitly
region := "us-east-1"
auth, err := awsbootstrap.NewAWSAuthenticator(ctx, region)

region, err := awsbootstrap.RegionFromMetadata(ctx)
if err != nil {
    if strings.Contains(err.Error(), "failed to get region from ec2 metadata") {
        // not on EC2 or IMDS blocked - use configured region
        region = cfgFlag.Region
    }
    return fmt.Errorf("resolving region: %w", err)
}

When it happens

Trigger: Calling RegionFromMetadata on a machine without EC2 IMDS (laptop, on-prem, non-AWS cloud), with IMDS disabled or set to require tokens while blocked, with a hop limit too low for container/overlay networking, or with a proxy/firewall dropping 169.254.169.254.

Common situations: Running kops AWS bootstrap commands inside a Docker/Kubernetes pod where IMDSv2 hop limit is 1; IMDS disabled on the instance for hardening; running the tool locally on a developer machine; iptables or security software blocking link-local metadata traffic.

Related errors

• getting primary MAC address from ec2 metadata: %w
• error querying ec2 metadata service (for region): %v
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w
• reading primary MAC address from ec2 metadata: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3e68c8e6c8752735. Report an issue: GitHub.