S3_SECRET_ACCESS_KEY cannot be empty when S3_ENDPOINT is not

Error message

S3_SECRET_ACCESS_KEY cannot be empty when S3_ENDPOINT is not empty

What it means

Configuration guard in getCustomS3Config: S3_ENDPOINT was set to a custom S3-compatible backend and S3_ACCESS_KEY_ID was provided, but the matching S3_SECRET_ACCESS_KEY environment variable is empty. Static credentials are incomplete, so the AWS config cannot be built and the S3 client is not created.

Source

Thrown at util/pkg/vfs/s3context.go:132

			return nil, err
		}
	}

	s3Client := s3.NewFromConfig(config, optFn)

	s.clients[region] = s3Client

	return s3Client, nil
}

func getCustomS3Config(ctx context.Context, region string) (aws.Config, error) {
	accessKeyID := os.Getenv("S3_ACCESS_KEY_ID")
	if accessKeyID == "" {
		return aws.Config{}, fmt.Errorf("S3_ACCESS_KEY_ID cannot be empty when S3_ENDPOINT is not empty")
	}
	secretAccessKey := os.Getenv("S3_SECRET_ACCESS_KEY")
	if secretAccessKey == "" {
		return aws.Config{}, fmt.Errorf("S3_SECRET_ACCESS_KEY cannot be empty when S3_ENDPOINT is not empty")
	}

	s3Config, err := awsconfig.LoadDefaultConfig(ctx,
		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, "")),
		awsconfig.WithRegion(region),
	)
	if err != nil {
		return aws.Config{}, fmt.Errorf("error loading AWS config: %v", err)
	}
	return s3Config, nil
}

func (s *S3Context) getDetailsForBucket(ctx context.Context, bucket string) (*S3BucketDetails, error) {
	s.mutex.Lock()
	bucketDetails := s.bucketDetails[bucket]
	s.mutex.Unlock()

	if bucketDetails != nil && bucketDetails.region != "" {

View on GitHub (pinned to 4c8573c808)

Solutions

Export S3_SECRET_ACCESS_KEY corresponding to the configured access key
Or remove S3_ENDPOINT/S3_ACCESS_KEY_ID to fall back to default AWS credential chain

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at util/pkg/vfs/s3context.go:132 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2695c3a1eca46d73. Report an issue: GitHub.