kubernetes/kops · error

failed to load default aws config: %w

Error message

failed to load default aws config: %w

What it means

RegionFromMetadata in pkg/bootstrap/awsbootstrap loads a default AWS SDK v2 config (credential/config chain) in order to create an IMDS client. If awsconfig.LoadDefaultConfig fails - which is unusual because loading itself defers most errors, but can fail on malformed shared config files or bad environment - the error is wrapped and returned. This runs on nodes bootstrapping via the AWS bootstrap authenticator.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:60

type awsAuthenticator struct {
	// sts holds the AWS STS client, for signing V2 requests
	sts *sts.Client

	// region holds the AWS region in which we are running
	region string

	// credentialsProvider returns our AWS credentials, for sigining V1 requests
	credentialsProvider aws.CredentialsProvider
}

var _ bootstrap.Authenticator = (*awsAuthenticator)(nil)

// RegionFromMetadata returns the current region from the aws metdata
func RegionFromMetadata(ctx context.Context) (string, error) {
	cfg, err := awsconfig.LoadDefaultConfig(ctx)
	if err != nil {
		return "", fmt.Errorf("failed to load default aws config: %w", err)
	}
	metadata := imds.NewFromConfig(cfg)

	resp, err := metadata.GetRegion(ctx, &imds.GetRegionInput{})
	if err != nil {
		return "", fmt.Errorf("failed to get region from ec2 metadata: %w", err)
	}
	return resp.Region, nil
}

func NewAWSAuthenticator(ctx context.Context, region string) (bootstrap.Authenticator, error) {
	config, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %w", err)
	}
	return &awsAuthenticator{
		credentialsProvider: config.Credentials,
		region:              region,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the AWS shared config/credentials files: run `aws sts get-caller-identity` to reproduce, and correct syntax errors in ~/.aws/config or the file named by AWS_CONFIG_FILE.
2. Unset or fix AWS_PROFILE, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE env vars pointing at bad files.
3. If no local config is wanted, run on an EC2 instance relying on IMDS with no broken shared config, or pass an explicit region-based config instead of RegionFromMetadata.

Example fix

// before (shell env on the host)
AWS_PROFILE=nonexistent-profile
// after
unset AWS_PROFILE  # or set AWS_PROFILE=default with a valid profile in ~/.aws/config

region, err := awsbootstrap.RegionFromMetadata(ctx)
if err != nil {
    if strings.Contains(err.Error(), "failed to load default aws config") {
        // fall back to explicit region from flag/env instead of config chain
        region = os.Getenv("AWS_REGION")
    }
    return fmt.Errorf("resolving region: %w", err)
}

When it happens

Trigger: Calling RegionFromMetadata(ctx) on a machine where the AWS config-loading chain fails: corrupted or syntactically invalid ~/.aws/config or ~/.aws/credentials, malformed AWS_SDK_LOAD_CONFIG content, or invalid profile references (source_profile pointing to a missing profile).

Common situations: Running kops/node tooling on a workstation with a hand-edited AWS shared config containing syntax errors; a broken AWS_PROFILE referencing a nonexistent profile; bad values in AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE env vars.

Related errors

• failed to load aws config: %w
• failed to get region from ec2 metadata: %w
• error loading default AWS config: %v
• building nodeConfig for instanceGroup: %w
• error loading secret %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/efb9fb21d9666534. Report an issue: GitHub.