kubernetes/kops · error

S3_ACCESS_KEY_ID cannot be empty when S3_ENDPOINT is not emp

Error message

S3_ACCESS_KEY_ID cannot be empty when S3_ENDPOINT is not empty

What it means

Configuration guard in getCustomS3Config: a non-AWS S3 endpoint was supplied via S3_ENDPOINT (static credentials mode), but the S3_ACCESS_KEY_ID environment variable is empty. Custom endpoints cannot use AWS SigV4 credential chains, so an explicit access key is mandatory and client construction aborts.

Source

Thrown at util/pkg/vfs/s3context.go:128

		// Use customized S3 storage
		klog.V(2).Infof("Found S3_ENDPOINT=%q, using as non-AWS S3 backend", endpoint)
		config, err = getCustomS3Config(ctx, region)
		if err != nil {
			return nil, err
		}
	}

	s3Client := s3.NewFromConfig(config, optFn)

	s.clients[region] = s3Client

	return s3Client, nil
}

func getCustomS3Config(ctx context.Context, region string) (aws.Config, error) {
	accessKeyID := os.Getenv("S3_ACCESS_KEY_ID")
	if accessKeyID == "" {
		return aws.Config{}, fmt.Errorf("S3_ACCESS_KEY_ID cannot be empty when S3_ENDPOINT is not empty")
	}
	secretAccessKey := os.Getenv("S3_SECRET_ACCESS_KEY")
	if secretAccessKey == "" {
		return aws.Config{}, fmt.Errorf("S3_SECRET_ACCESS_KEY cannot be empty when S3_ENDPOINT is not empty")
	}

	s3Config, err := awsconfig.LoadDefaultConfig(ctx,
		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, "")),
		awsconfig.WithRegion(region),
	)
	if err != nil {
		return aws.Config{}, fmt.Errorf("error loading AWS config: %v", err)
	}
	return s3Config, nil
}

func (s *S3Context) getDetailsForBucket(ctx context.Context, bucket string) (*S3BucketDetails, error) {
	s.mutex.Lock()

View on GitHub (pinned to 4c8573c808)

Solutions

1. Export S3_ACCESS_KEY_ID with the access key for the custom S3-compatible backend
2. Or clear S3_ENDPOINT to use standard AWS credential resolution

When it happens

Trigger: Thrown at util/pkg/vfs/s3context.go:128 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5e56dd5cdac9311c. Report an issue: GitHub.