kubernetes/kops · error

failed to load default aws config for IMDS client: %w

Error message

failed to load default aws config for IMDS client: %w

What it means

newRoute53 first loads a default AWS config (via aws config.LoadDefaultConfig) solely to build an EC2 IMDS client used to discover the region. If LoadDefaultConfig fails while building that IMDS config, the error is wrapped and returned.

Source

Thrown at dnsprovider/pkg/dnsprovider/providers/aws/route53/route53.go:60

var MaxBatchSize = 900

func init() {
	dnsprovider.RegisterDNSProvider(ProviderName, func(config io.Reader) (dnsprovider.Interface, error) {
		return newRoute53()
	})
}

// newRoute53 creates a new instance of an AWS Route53 DNS Interface.
func newRoute53() (*Interface, error) {
	ctx := context.TODO()

	imdsCfg, err := awsconfig.LoadDefaultConfig(ctx,
		awsconfig.WithRetryer(func() aws.Retryer {
			return retry.AddWithMaxAttempts(retry.NewStandard(), 5)
		}),
	)
	if err != nil {
		return nil, fmt.Errorf("failed to load default aws config for IMDS client: %w", err)
	}
	imdsClient := imds.NewFromConfig(imdsCfg)

	var region string
	imdsRegionResp, err := imdsClient.GetRegion(ctx, &imds.GetRegionInput{})
	if err != nil {
		klog.V(4).Infof("Unable to discover region by IMDS, using SDK defaults: %s", err)
		// Don't use imdsClient if it's erroring (we're probably not running on EC2 here, e.g. kops update)
		imdsClient = nil
	} else {
		region = imdsRegionResp.Region
	}

	awsOptions := []func(*awsconfig.LoadOptions) error{
		awsconfig.WithClientLogMode(aws.LogRetries),
		awslog.WithAWSLogger(),
		awsconfig.WithRetryer(func() aws.Retryer {
			return retry.AddWithMaxAttempts(retry.NewStandard(), 5)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %w error for the underlying config-load cause and fix that file/setting.
2. Validate ~/.aws/config and ~/.aws/credentials syntax; unset AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE if mispointed.
3. Test with `aws sts get-caller-identity` using the same profile to confirm config validity.
4. Unset AWS_PROFILE (or pick a valid one) and retry.

// pre-flight: ensure AWS config files parse
if os.Getenv("AWS_CONFIG_FILE") != "" {
    if _, err := os.Stat(os.Getenv("AWS_CONFIG_FILE")); err != nil {
        return fmt.Errorf("AWS_CONFIG_FILE missing: %w", err)
    }
}

zone, err := dnsprovider.InitDnsProvider("aws-route53", ...)
if err != nil && strings.Contains(err.Error(), "failed to load default aws config for IMDS client") {
    // surface the wrapped cause: errors.Unwrap(err) and inspect *aws.ConfigLoadError
    return fmt.Errorf("check ~/.aws/config and AWS_PROFILE: %w", err)
}

When it happens

Trigger: Calling newRoute53 when LoadDefaultConfig fails for the initial IMDS config load — e.g. malformed AWS_PROFILE, unreadable/broken shared config files (~/.aws/config, ~/.aws/credentials), invalid env values, or SDK config loading errors.

Common situations: Corrupt or syntactically invalid ~/.aws/config; AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE pointing at missing files; malformed SSO or assume-role profiles; bad AWS_RETRY_MODE or other env values the SDK rejects.

Related errors

• failed to load default aws config for STS client: %w
• error applying DNS changeset for zone %s: %v
• failed to load default aws config: %w
• error listing resource record sets: %w
• error listing hosted zones: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/51d0c8352039261a. Report an issue: GitHub.