openai/codex · error · AwsAuthError

AWS SDK config did not resolve a region

Error message

AWS SDK config did not resolve a region

What it means

SigV4 requires a concrete region (it is part of the canonical request and the signing scope), so after loading the SDK config, AwsAuthContext::load calls resolved_region, which maps a None region to this error. It fires when AwsAuthConfig.region was not set and the SDK also found no region via AWS_REGION/AWS_DEFAULT_REGION or the active profile's 'region' key.

Source

Thrown at codex-rs/aws-auth/src/lib.rs:51

}

/// Signed request parts returned to the caller.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AwsSignedRequest {
    pub url: String,
    pub headers: HeaderMap,
}

/// Errors returned by credential loading or SigV4 signing.
#[derive(Debug, Error)]
pub enum AwsAuthError {
    #[error("AWS service name must not be empty")]
    EmptyService,
    #[error("AWS profile must be configured")]
    MissingProfile,
    #[error("AWS SDK config did not resolve a credentials provider")]
    MissingCredentialsProvider,
    #[error("AWS SDK config did not resolve a region")]
    MissingRegion,
    #[error("failed to load AWS profiles: {0}")]
    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),
    #[error("failed to load AWS credentials: {0}")]
    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),
    #[error("request URL is not a valid URI: {0}")]
    InvalidUri(#[source] http::uri::InvalidUri),
    #[error("failed to construct HTTP request for signing: {0}")]
    BuildHttpRequest(#[source] http::Error),
    #[error("request contains a non-UTF8 header value: {0}")]
    InvalidHeaderValue(#[source] http::header::ToStrError),
    #[error("failed to build signable request: {0}")]
    SigningRequest(#[source] aws_sigv4::http_request::SigningError),
    #[error("failed to build SigV4 signing params: {0}")]
    SigningParams(String),
    #[error("SigV4 signing failed: {0}")]
    SigningFailure(#[source] aws_sigv4::http_request::SigningError),
}

View on GitHub (pinned to 339751715c)

Solutions

1. Set AwsAuthConfig.region = Some("us-east-1") explicitly at the call site
2. Or export AWS_REGION / AWS_DEFAULT_REGION in the environment
3. Or add 'region = <region>' under the named profile in ~/.aws/config

Example fix

// before
let ctx = AwsAuthContext::load(AwsAuthConfig {
    profile: None, region: None, service: "s3".into(),
}).await?; // MissingRegion

// after
let ctx = AwsAuthContext::load(AwsAuthConfig {
    profile: None, region: Some("us-east-1".into()), service: "s3".into(),
}).await?;

let region = config.region.clone()
    .or_else(|| std::env::var("AWS_REGION").ok())
    .or_else(|| std::env::var("AWS_DEFAULT_REGION").ok())
    .ok_or("AWS region required for SigV4");
let ctx = AwsAuthContext::load(AwsAuthConfig { region: region.ok(), ..config }).await?;

fn is_missing_region(e: &AwsAuthError) -> bool {
    matches!(e, AwsAuthError::MissingRegion)
}

match AwsAuthContext::load(config).await {
    Err(e @ AwsAuthError::MissingRegion) => return Err(config_error(e)), // fix config, do not retry
    other => other?,
}

When it happens

Trigger: AwsAuthConfig with region: None where neither AWS_REGION nor AWS_DEFAULT_REGION is exported and the active profile in ~/.aws/config has no region line; CI shells that strip environment variables.

Common situations: aws configure completed without answering the region prompt; profiles generated by tools that omit region; new integrations assuming region is optional (as it is for some AWS APIs) when SigV4 signing mandates it.

Related errors

• AWS service name must not be empty
• AWS profile must be configured
• current-time request timed out after {}s
• InvalidInput
• AWS SDK config did not resolve a credentials provider

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/d379592b123cb5dc. Report an issue: GitHub.