openai/codex · error · AwsAuthError

AWS service name must not be empty

Error message

AWS service name must not be empty

What it means

AwsAuthContext::load (and load_profile, which delegates to it) calls load_sdk_config, which rejects the call up front when AwsAuthConfig.service is empty after trimming. The service name (e.g. 's3', 'execute-api', 'bedrock') is required input for SigV4 signing, so an empty one is a programming or configuration error, not an environment problem. AwsAuthError::is_retryable() classifies it as non-retryable.

Source

Thrown at codex-rs/aws-auth/src/lib.rs:45

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AwsRequestToSign {
    pub method: Method,
    pub url: String,
    pub headers: HeaderMap,
    pub body: Bytes,
}

/// Signed request parts returned to the caller.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AwsSignedRequest {
    pub url: String,
    pub headers: HeaderMap,
}

/// Errors returned by credential loading or SigV4 signing.
#[derive(Debug, Error)]
pub enum AwsAuthError {
    #[error("AWS service name must not be empty")]
    EmptyService,
    #[error("AWS profile must be configured")]
    MissingProfile,
    #[error("AWS SDK config did not resolve a credentials provider")]
    MissingCredentialsProvider,
    #[error("AWS SDK config did not resolve a region")]
    MissingRegion,
    #[error("failed to load AWS profiles: {0}")]
    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),
    #[error("failed to load AWS credentials: {0}")]
    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),
    #[error("request URL is not a valid URI: {0}")]
    InvalidUri(#[source] http::uri::InvalidUri),
    #[error("failed to construct HTTP request for signing: {0}")]
    BuildHttpRequest(#[source] http::Error),
    #[error("request contains a non-UTF8 header value: {0}")]
    InvalidHeaderValue(#[source] http::header::ToStrError),
    #[error("failed to build signable request: {0}")]

View on GitHub (pinned to 339751715c)

Solutions

1. Set AwsAuthConfig.service to the target AWS service signing name ('s3', 'execute-api', 'bedrock', ...)
2. If service comes from config or env, validate it is non-empty after trimming before constructing AwsAuthConfig
3. Fail fast at config parse time with a message naming the missing field

Example fix

// before
let ctx = AwsAuthContext::load(AwsAuthConfig {
    profile: None, region: Some("us-east-1".into()), service: String::new(),
}).await?; // EmptyService

// after
let ctx = AwsAuthContext::load(AwsAuthConfig {
    profile: None, region: Some("us-east-1".into()), service: "s3".into(),
}).await?;

if config.service.trim().is_empty() {
    return Err("aws service name is required for signing");
}
let ctx = AwsAuthContext::load(config).await?;

fn is_empty_service(e: &AwsAuthError) -> bool {
    matches!(e, AwsAuthError::EmptyService)
}

match AwsAuthContext::load(config).await {
    Err(e @ AwsAuthError::EmptyService) => return Err(config_error(e)), // not retryable
    Err(AwsAuthError::Credentials(c)) => /* provider failed: check env */ (),
    other => other?,
}

When it happens

Trigger: Constructing AwsAuthConfig with service: String::new() or a whitespace-only service string and calling AwsAuthContext::load or load_profile; service populated from an optional setting or env var that defaulted to empty.

Common situations: Config plumbing where the service string comes from an optional field nobody set; new integration wiring where the service argument was forgotten.

Related errors

• AWS SDK config did not resolve a region
• AWS profile must be configured
• current-time request timed out after {}s
• InvalidInput
• AWS SDK config did not resolve a credentials provider

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/0612dc42d53f94af. Report an issue: GitHub.