kubernetes/kops · error

got an error while querying for valid regions (verify your A

Error message

got an error while querying for valid regions (verify your AWS credentials?): %v

What it means

ValidateRegion calls EC2 DescribeRegions to fetch the list of valid regions; if that API call fails, the error is wrapped with this message, explicitly hinting the usual cause is bad AWS credentials. This means authentication/authorization or connectivity failed when querying EC2's region list. It is distinct from config-loading failures — the config loaded, but the API call itself was rejected or could not reach EC2.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:71

		request := &ec2.DescribeRegionsInput{}
		awsRegion := os.Getenv("AWS_REGION")
		if awsRegion == "" {
			awsRegion = "us-east-1"
		}
		cfg, err := loadAWSConfig(ctx, awsRegion)
		if err != nil {
			return fmt.Errorf("error loading AWS config: %v", err)
		}

		if err != nil {
			return fmt.Errorf("error starting a new AWS session: %v", err)
		}

		client := ec2.NewFromConfig(cfg)

		response, err := client.DescribeRegions(ctx, request)
		if err != nil {
			return fmt.Errorf("got an error while querying for valid regions (verify your AWS credentials?): %v", err)
		}
		allRegions = response.Regions
	}

	for _, r := range allRegions {
		name := aws.ToString(r.RegionName)
		if name == region {
			return nil
		}
	}

	if os.Getenv("SKIP_REGION_CHECK") != "" {
		klog.Infof("AWS region does not appear to be valid, but skipping because SKIP_REGION_CHECK is set")
		return nil
	}

	return fmt.Errorf("Region is not a recognized EC2 region: %q (check you have specified valid zones?)", region)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws ec2 describe-regions` with the same credentials to reproduce and see the underlying AWS error
2. Fix/refresh credentials (expired keys, stale SSO token, wrong AWS_ACCESS_KEY_ID/SECRET)
3. Check network/proxy reachability to the EC2 endpoint and system clock skew
4. Grant ec2:DescribeRegions in the IAM policy if authorization is the cause

Example fix

// before (CI)
AWS_ACCESS_KEY_ID=AKIA...   # revoked key
// after
# refresh credentials, e.g.
aws sso login --profile staging-admin && export AWS_PROFILE=staging-admin

// preflight the credentials with the AWS CLI before kops
// aws ec2 describe-regions --region us-east-1 && kops ...

err := kopsValidateRegion(ctx, region)
if err != nil && strings.Contains(err.Error(), "verify your AWS credentials") {
    // inspect the wrapped AWS error, refresh credentials, then retry
    return refreshCredsAndRetry(ctx, region)
}

When it happens

Trigger: client.DescribeRegions returns an error during ValidateRegion — e.g. InvalidClientTokenId, expired credentials, network/DNS failure reaching ec2.<region>.amazonaws.com, or STS/credential refresh failure.

Common situations: Wrong or placeholder AWS keys in CI, expired SSO sessions, corporate proxy blocking EC2 endpoints, clock skew invalidating SigV4 signatures, or IAM policy denying ec2:DescribeRegions.

Related errors

• describing instance for arn %q
• error terminating instances: %v
• error describing instances: %v
• error describing addresses: %v
• error describing volumes: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5afbac6c46ebf8ea. Report an issue: GitHub.