kubernetes/kops · error

failed to load default aws config for STS client: %w

Error message

failed to load default aws config for STS client: %w

What it means

Wraps a failure of awsconfig.LoadDefaultConfig while the Route53 DNS provider builds a dedicated STS client config (when an IMDS client is supplied). AWS SDK config resolution — credentials, region, or IMDS interaction — failed before any DNS API call was made.

Source

Thrown at dnsprovider/pkg/dnsprovider/providers/aws/route53/route53.go:92

	awsOptions := []func(*awsconfig.LoadOptions) error{
		awsconfig.WithClientLogMode(aws.LogRetries),
		awslog.WithAWSLogger(),
		awsconfig.WithRetryer(func() aws.Retryer {
			return retry.AddWithMaxAttempts(retry.NewStandard(), 5)
		}),
	}

	if imdsClient != nil {
		stsCfg, err := awsconfig.LoadDefaultConfig(ctx,
			awsconfig.WithClientLogMode(aws.LogRetries),
			awslog.WithAWSLogger(),
			awsconfig.WithRetryer(func() aws.Retryer {
				return retry.AddWithMaxAttempts(retry.NewStandard(), 5)
			}),
			awsconfig.WithRegion(region),
		)
		if err != nil {
			return nil, fmt.Errorf("failed to load default aws config for STS client: %w", err)
		}

		awsOptions = append(
			awsOptions,
			awsconfig.WithEC2IMDSRegion(func(o *awsconfig.UseEC2IMDSRegion) {
				o.Client = imdsClient
			}),
			awsconfig.WithAssumeRoleCredentialOptions(func(aro *stscreds.AssumeRoleOptions) {
				// Ensure the STS client has a region configured, if discovered by IMDS
				aro.Client = sts.NewFromConfig(stsCfg)
			}),
		)
	}

	cfg, err := awsconfig.LoadDefaultConfig(ctx, awsOptions...)
	if err != nil {
		return nil, fmt.Errorf("failed to load default aws config: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error and fix the offending shared config/credential profile (e.g. re-run `aws sso login`).
2. Verify the referenced source_profile / role_arn entries exist and are valid.
3. Set explicit valid AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env credentials as a fallback.
4. Re-test with `aws sts get-caller-identity --profile <name>`.

// validate the profile resolves before calling the library
out, err := exec.Command("aws", "sts", "get-caller-identity", "--profile", os.Getenv("AWS_PROFILE")).Output()
if err != nil {
    return fmt.Errorf("AWS profile invalid or SSO expired: %w", err)
}
_ = out

if err != nil && strings.Contains(err.Error(), "failed to load default aws config for STS client") {
    // SSO/assume-role profiles are the usual culprit; re-authenticate
    return fmt.Errorf("run 'aws sso login' or fix profile: %w", err)
}

When it happens

Trigger: newRoute53 running on an EC2 instance (region discovered via IMDS) whose second LoadDefaultConfig — with WithRegion(region) and the standard retryer — fails due to invalid profile/SSO/credential-file configuration.

Common situations: Expired SSO session in the profile; invalid assume-role source profile; shared config file changed between the two loads; region value from IMDS combined with a profile that has incompatible settings.

Related errors

• failed to load default aws config for IMDS client: %w
• error applying DNS changeset for zone %s: %v
• failed to load default aws config: %w
• error listing resource record sets: %w
• error listing hosted zones: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0638d8be432f86aa. Report an issue: GitHub.