kubernetes/kops · error

failed to load AWS config: %w

Error message

failed to load AWS config: %w

What it means

readAWSMetadata (reached via metadata://aws/... URLs in ReadFile) first calls aws-sdk-go-v2 config.LoadDefaultConfig. If the AWS SDK cannot assemble a usable configuration (bad credential chain, invalid shared config file, unusable region), the error is wrapped as 'failed to load AWS config'.

Source

Thrown at util/pkg/vfs/context.go:229

		return c.buildOpenstackSwiftPath(p)
	}

	if strings.HasPrefix(p, "azureblob://") {
		return c.buildAzureBlobPath(p)
	}

	if strings.HasPrefix(p, "scw://") {
		return c.buildSCWPath(p)
	}

	return nil, fmt.Errorf("unknown / unhandled path type: %q", p)
}

// readAWSMetadata reads the specified path from the AWS EC2 metadata service
func (c *VFSContext) readAWSMetadata(ctx context.Context, path string) ([]byte, error) {
	config, err := awsconfig.LoadDefaultConfig(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to load AWS config: %w", err)
	}

	client := imds.NewFromConfig(config)

	if strings.HasPrefix(path, "/meta-data/") {
		s, err := client.GetMetadata(ctx, &imds.GetMetadataInput{
			Path: strings.TrimPrefix(path, "/meta-data/"),
		})
		if err != nil {
			return nil, fmt.Errorf("error reading from AWS metadata service: %v", err)
		}
		defer s.Content.Close()
		return io.ReadAll(s.Content)
	}
	// There are others (e.g. user-data), but as we don't use them yet let's not expose them
	return nil, fmt.Errorf("unhandled aws metadata path %q", path)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws sts get-caller-identity` to verify the SDK default config loads; fix whatever it reports
2. Inspect ~/.aws/config and ~/.aws/credentials for syntax errors and fix them
3. Unset conflicting AWS_* env vars (AWS_PROFILE, AWS_CONFIG_FILE, AWS_ROLE_ARN/AWS_WEB_IDENTITY_TOKEN_FILE) or set them correctly
4. Ensure AWS_REGION or a default region is resolvable if the error is region-related

Example fix

// before
export AWS_PROFILE="nonexistent-profile"
// after
export AWS_PROFILE="default" # or a profile present in ~/.aws/config

if _, err := awsconfig.LoadDefaultConfig(context.TODO()); err != nil {
	return fmt.Errorf("AWS SDK config cannot load; fix ~/.aws config/env before running: %w", err)
}

func awsConfigLoadable(ctx context.Context) bool {
	_, err := awsconfig.LoadDefaultConfig(ctx)
	return err == nil
}

data, err := vfs.Context.ReadFile("metadata://aws/meta-data/instance-id")
if err != nil && strings.Contains(err.Error(), "failed to load AWS config") {
	return fmt.Errorf("check AWS credentials/config (~/.aws, AWS_* env vars, profile): %w", err)
}

When it happens

Trigger: Calling ReadFile('metadata://aws/...') on a machine where LoadDefaultConfig fails: malformed ~/.aws/config or ~/.aws/credentials, invalid AWS_PROFILE, malformed AWS_* environment variables, or explicitly-configured sources that error (e.g. bad assume-role config, invalid SSO settings).

Common situations: Running a kOps binary on an EC2 host with a corrupted AWS config file; exporting AWS_REGION='' or a syntactically invalid profile; SSO token cache expired with cached profile settings.

Related errors

• error loading AWS config: %v
• error loading AWS config: %v
• error loading default AWS config: %v
• error initializing AWS client: %v
• failed to load default aws config for IMDS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aa92efabc8d2d018. Report an issue: GitHub.