kubernetes/kops · error

failed to load aws config: %w

Error message

failed to load aws config: %w

What it means

NewAWSAuthenticator builds an awsAuthenticator from an explicitly provided region: it calls awsconfig.LoadDefaultConfig with WithRegion(region) and wires credentials and an STS client. If loading the default config fails (malformed shared config/credentials, invalid profile chain), the SDK error is wrapped with this message. Called from bootstrap client Build and getNodeConfigFromServers.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:74

// RegionFromMetadata returns the current region from the aws metdata
func RegionFromMetadata(ctx context.Context) (string, error) {
	cfg, err := awsconfig.LoadDefaultConfig(ctx)
	if err != nil {
		return "", fmt.Errorf("failed to load default aws config: %w", err)
	}
	metadata := imds.NewFromConfig(cfg)

	resp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})
	if err != nil {
		return "", fmt.Errorf("failed to get region from ec2 metadata: %w", err)
	}
	return resp.Region, nil
}

func NewAWSAuthenticator(ctx context.Context, region string) (bootstrap.Authenticator, error) {
	config, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %w", err)
	}
	return &awsAuthenticator{
		credentialsProvider: config.Credentials,
		region:              region,
		sts:                 sts.NewFromConfig(config),
	}, nil
}

// awsV1Token is the format of the V1 request, it matches http.Header
type awsV1Token map[string][]string

// awsV2Token is the format of the V2 request, it maps to the http request generated by STS GetCallerIdentity
type awsV2Token struct {
	URL          string      `json:"url"`
	Method       string      `json:"method"`
	SignedHeader http.Header `json:"headers"`
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate the ambient config with `aws sts get-caller-identity --region <region>`; fix syntax or profile errors in ~/.aws/config and ~/.aws/credentials.
2. Unset/fix AWS_PROFILE, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE, and ensure credential process/plugin referenced by the profile works.
3. In containers/CI, mount or generate valid credentials (instance role or static keys) and confirm the file is readable by the running user.

Example fix

// before (~/.aws/config)
[profile kops]
source_profile = does-not-exist
// after
[profile kops]
role_arn = arn:aws:iam::123456789012:role/kops
source_profile = default

auth, err := awsbootstrap.NewAWSAuthenticator(ctx, region)
if err != nil {
    if strings.Contains(err.Error(), "failed to load aws config") {
        return fmt.Errorf("check AWS shared config/profiles for region %s: %w", region, err)
    }
    return err
}

When it happens

Trigger: Calling NewAWSAuthenticator(ctx, region) where the ambient AWS config chain fails: broken ~/.aws/config syntax, AWS_PROFILE referencing a missing profile, invalid source_profile/role_arn chains, or bad AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE paths.

Common situations: Using kops bootstrap on a bastion/CI runner whose AWS config file was hand-edited; role assumption chain in shared config pointing at a nonexistent profile; permissions issue reading the credentials file in a container.

Related errors

• failed to load default aws config: %w
• error loading default AWS config: %v
• failed to get region from ec2 metadata: %w
• getting AWS credentials: %w
• building nodeConfig for instanceGroup: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ab12caf6a4766090. Report an issue: GitHub.