risingwavelabs/risingwave · error

missing aws region

Error message

missing aws region

What it means

AWS MSK IAM authentication signs requests with SigV4, which requires an AWS region. When `is_aws_msk_iam` is true but the resolved AWS SDK config has no region, context creation fails with this error.

Source

Thrown at src/connector/src/source/kafka/client_context.rs:70

impl KafkaContextCommon {
    pub async fn new(
        broker_rewrite_map: Option<BTreeMap<String, String>>,
        identifier: Option<String>,
        metrics: Option<Arc<RdKafkaStats>>,
        auth: AwsAuthProps,
        is_aws_msk_iam: bool,
    ) -> ConnectorResult<Self> {
        let addr_rewriter =
            BrokerAddrRewriter::new(PrivateLinkContextRole::Consumer, broker_rewrite_map)?;
        let auth = if is_aws_msk_iam {
            let config = auth.build_config().await?;
            let credentials_provider = config
                .credentials_provider()
                .ok_or_else(|| anyhow!("missing aws credentials_provider"))?;
            let region = config
                .region()
                .ok_or_else(|| anyhow!("missing aws region"))?
                .clone();
            Some(IamAuthEnv {
                credentials_provider,
                region,
                signer_timeout_sec: auth
                    .msk_signer_timeout_sec
                    .unwrap_or(Self::default_msk_signer_timeout_sec()),
            })
        } else {
            None
        };
        Ok(Self {
            addr_rewriter,
            identifier,
            metrics,
            auth,
        })
    }

View on GitHub (pinned to 6469eb736d)

Solutions

1. Add `aws.region='<cluster-region>'` to the WITH options (e.g. us-east-1) alongside `aws.auth.msk_iam = true`
2. Or set the AWS_REGION/AWS_DEFAULT_REGION environment variables in the RisingWave deployment
3. Verify with the region of the MSK cluster's bootstrap string (e.g. ...kafka.us-east-1.amazonaws.com implies us-east-1)

Example fix

// before
WITH (
  connector='kafka',
  aws.auth.msk_iam='true'
)
// after
WITH (
  connector='kafka',
  aws.auth.msk_iam='true',
  aws.region='us-east-1'
)

if msk_iam && with_options.get("aws.region").is_none() && std::env::var("AWS_REGION").is_err() {
    return Err("aws.region is required for aws.auth.msk_iam");
}

When it happens

Trigger: Creating a KafkaContextCommon with `is_aws_msk_iam=true` while AwsAuthProps lacks `aws.region` (or `AWS_REGION`/`AWS_DEFAULT_REGION` env and profile region are unset).

Common situations: User enables `aws.auth.msk_iam = true` but omits the `aws.region` WITH option; running in a container without AWS_REGION env; region only set in a profile that is not loaded.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• PrivateLink endpoint not found
• missing aws credentials_provider
• failed to generate AWS MSK IAM token
• The number of broker addrs {} does not match the number of p
• expected JSON in the form {{"host": "endpoint url"}}, but go

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/af60fe868008a76b. Report an issue: GitHub.