kubernetes/kops · error

failed to load default aws config: %w

Error message

failed to load default aws config: %w

What it means

This is the final LoadDefaultConfig call in newRoute53 that produces the config used for the actual Route53 client. Any failure assembling the SDK config (credentials chain, region resolution, profiles, IMDS options) is wrapped here.

Source

Thrown at dnsprovider/pkg/dnsprovider/providers/aws/route53/route53.go:109

		if err != nil {
			return nil, fmt.Errorf("failed to load default aws config for STS client: %w", err)
		}

		awsOptions = append(
			awsOptions,
			awsconfig.WithEC2IMDSRegion(func(o *awsconfig.UseEC2IMDSRegion) {
				o.Client = imdsClient
			}),
			awsconfig.WithAssumeRoleCredentialOptions(func(aro *stscreds.AssumeRoleOptions) {
				// Ensure the STS client has a region configured, if discovered by IMDS
				aro.Client = sts.NewFromConfig(stsCfg)
			}),
		)
	}

	cfg, err := awsconfig.LoadDefaultConfig(ctx, awsOptions...)
	if err != nil {
		return nil, fmt.Errorf("failed to load default aws config: %w", err)
	}

	// AWS_REGION, IMDS, or config profiles can override this in LoadDefaultConfig above.
	if cfg.Region == "" {
		cfg.Region = "us-east-1"
	}

	svc := route53.NewFromConfig(cfg)

	return New(svc), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Provide credentials: export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (and AWS_REGION) or configure a valid profile.
2. If on EC2, verify the instance has an instance profile and IMDSv2 is reachable (hops limit >= 1).
3. Check the wrapped error to identify which chain element failed (credential provider vs profile parse).
4. Set AWS_REGION explicitly to skip IMDS region resolution.

Example fix

// before
// no credentials configured
// after
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_REGION=us-east-1

// ensure the credential chain can resolve before calling the library
if os.Getenv("AWS_ACCESS_KEY_ID") == "" && os.Getenv("AWS_PROFILE") == "" {
    if _, err := os.Stat(filepath.Join(os.Getenv("HOME"), ".aws", "credentials")); err != nil {
        return errors.New("no AWS credentials available: set env vars or a profile")
    }
}

var cfgErr *aws.ConfigLoadError // or inspect wrapped chain
zone, err := dnsprovider.InitDnsProvider("aws-route53", ...)
if err != nil && strings.Contains(err.Error(), "failed to load default aws config") {
    return fmt.Errorf("no AWS credentials/region resolvable: %w", err)
}

When it happens

Trigger: newRoute53's main LoadDefaultConfig(ctx, awsOptions...) fails — typically because no credentials could be resolved by the default chain (env, profile, IMDS) or an option (WithEC2IMDSRegion using the custom imdsClient) errors.

Common situations: Running outside AWS with no ~/.aws credentials and no env vars; expired credentials in a profile; EC2 instance profile missing/IMDS unreachable (IMDSv2 hops limit); missing route53:GetHostedZones-style permission is NOT this error — this one is purely config assembly.

Related errors

• error loading default AWS config: %v
• error initializing AWS client: %v
• error applying DNS changeset for zone %s: %v
• failed to load default aws config for IMDS client: %w
• failed to load default aws config for STS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/69480c66c65710a1. Report an issue: GitHub.