openai/codex · error · AwsAuthError

AWS profile must be configured

Error message

AWS profile must be configured

What it means

AwsAuthContext::load_profile requires an explicitly named profile: it returns AwsAuthError::MissingProfile immediately when AwsAuthConfig.profile is None. The plain AwsAuthContext::load entry point does not raise this - it uses default AWS SDK credential-chain resolution. Non-retryable per is_retryable().

Source

Thrown at codex-rs/aws-auth/src/lib.rs:47

    pub method: Method,
    pub url: String,
    pub headers: HeaderMap,
    pub body: Bytes,
}

/// Signed request parts returned to the caller.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AwsSignedRequest {
    pub url: String,
    pub headers: HeaderMap,
}

/// Errors returned by credential loading or SigV4 signing.
#[derive(Debug, Error)]
pub enum AwsAuthError {
    #[error("AWS service name must not be empty")]
    EmptyService,
    #[error("AWS profile must be configured")]
    MissingProfile,
    #[error("AWS SDK config did not resolve a credentials provider")]
    MissingCredentialsProvider,
    #[error("AWS SDK config did not resolve a region")]
    MissingRegion,
    #[error("failed to load AWS profiles: {0}")]
    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),
    #[error("failed to load AWS credentials: {0}")]
    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),
    #[error("request URL is not a valid URI: {0}")]
    InvalidUri(#[source] http::uri::InvalidUri),
    #[error("failed to construct HTTP request for signing: {0}")]
    BuildHttpRequest(#[source] http::Error),
    #[error("request contains a non-UTF8 header value: {0}")]
    InvalidHeaderValue(#[source] http::header::ToStrError),
    #[error("failed to build signable request: {0}")]
    SigningRequest(#[source] aws_sigv4::http_request::SigningError),
    #[error("failed to build SigV4 signing params: {0}")]

View on GitHub (pinned to 339751715c)

Solutions

1. Set AwsAuthConfig.profile = Some("profilename") before calling load_profile
2. Or call AwsAuthContext::load to use the default credential chain (env vars, shared config, IMDS) with no profile
3. Source the profile name from AWS_PROFILE or your config schema with a required-field check

Example fix

// before
let ctx = AwsAuthContext::load_profile(AwsAuthConfig {
    profile: None, region: None, service: "s3".into(),
}).await?; // MissingProfile

// after
let ctx = AwsAuthContext::load_profile(AwsAuthConfig {
    profile: Some(std::env::var("AWS_PROFILE")?), region: None, service: "s3".into(),
}).await?;

let profile = std::env::var("AWS_PROFILE").ok()
    .or_else(|| config.aws_profile.clone())
    .filter(|p| !p.trim().is_empty())
    .ok_or("AWS profile required for load_profile")?;
let ctx = AwsAuthContext::load_profile(AwsAuthConfig { profile: Some(profile), ..config }).await?;

fn is_missing_profile(e: &AwsAuthError) -> bool {
    matches!(e, AwsAuthError::MissingProfile)
}

match AwsAuthContext::load_profile(cfg).await {
    Err(AwsAuthError::MissingProfile) => AwsAuthContext::load(cfg).await, // fallback to default chain
    other => other,
}

When it happens

Trigger: Passing AwsAuthConfig with profile: None to load_profile; the profile field populated from an optional env var or config key that was unset (e.g. forgot to read AWS_PROFILE into the struct).

Common situations: Code switched from load() to load_profile() without guaranteeing the profile field is set; AWS_PROFILE-driven setups where the app never copied the env var into AwsAuthConfig.

Related errors

• AWS service name must not be empty
• AWS SDK config did not resolve a region
• current-time request timed out after {}s
• InvalidInput
• AWS SDK config did not resolve a credentials provider

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/b620610b99ff7de2. Report an issue: GitHub.