kubernetes/kops · error

failed to load aws config: %w

Error message

failed to load aws config: %w

What it means

NewAWSVerifier wraps awsconfig.LoadDefaultConfig failure when constructing the kops node verifier on the server. It fires when no usable AWS credential chain / region can be resolved (missing env vars, no instance profile, invalid shared config) — the verifier cannot talk to AWS at all and cannot authenticate nodes.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:79

	accountId string
	partition string
	opt       AWSVerifierOptions

	ec2    *ec2.Client
	client http.Client

	stsRequestValidator *stsRequestValidator
}

var _ bootstrap.Verifier = (*awsVerifier)(nil)

func NewAWSVerifier(ctx context.Context, opt *AWSVerifierOptions) (bootstrap.Verifier, error) {
	config, err := awsconfig.LoadDefaultConfig(
		ctx,
		awsconfig.WithRegion(opt.Region),
	)
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %w", err)
	}

	stsClient := sts.NewFromConfig(config)
	identity, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
	if err != nil {
		return nil, err
	}

	partition := strings.Split(aws.ToString(identity.Arn), ":")[1]

	ec2Client := ec2.NewFromConfig(config)

	stsRequestValidator, err := buildSTSRequestValidator(ctx, stsClient)
	if err != nil {
		return nil, err
	}

	return &awsVerifier{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Provide valid AWS credentials (env, profile, or role)
2. Set a valid region
3. Check instance metadata access if on EC2

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:79 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/21faee8c0bcfa298. Report an issue: GitHub.