temporalio/temporal · error

failed to sign request: %w

Error message

failed to sign request: %w

What it means

After obtaining credentials and computing the payload hash, RoundTrip calls the AWS SDK v4 signer's SignHTTP to apply the SigV4 signature to the outgoing Elasticsearch request. If the signing operation itself fails, the request is aborted with this error.

Source

Thrown at common/persistence/visibility/store/elasticsearch/client/aws.go:46

func (t *awsSigningTransport) RoundTrip(req *http.Request) (*http.Response, error) {
	creds, err := t.creds.Retrieve(req.Context())
	if err != nil {
		return nil, fmt.Errorf("failed to retrieve AWS credentials: %w", err)
	}

	var bodyBytes []byte
	if req.Body != nil {
		bodyBytes, err = io.ReadAll(req.Body)
		if err != nil {
			return nil, fmt.Errorf("failed to read request body: %w", err)
		}
		req.Body = io.NopCloser(bytes.NewReader(bodyBytes))
	}

	hash := fmt.Sprintf("%x", sha256.Sum256(bodyBytes))
	err = t.signer.SignHTTP(req.Context(), creds, req, hash, t.service, t.region, time.Now())
	if err != nil {
		return nil, fmt.Errorf("failed to sign request: %w", err)
	}

	if bodyBytes != nil {
		// set the request body just in case the signer consumes the body
		req.Body = io.NopCloser(bytes.NewReader(bodyBytes))
	}

	return t.wrapped.RoundTrip(req)
}

func NewAwsHttpClient(config ESAWSRequestSigningConfig) (*http.Client, error) {
	if !config.Enabled {
		return nil, nil
	}

	if config.Region == "" {
		config.Region = os.Getenv("AWS_REGION")
		if config.Region == "" {

View on GitHub (pinned to bde624efd1)

Solutions

1. Check req.Context() cancellation — if context deadline exceeded, tune the visibility client timeout or investigate latency
2. Validate the configured signing region (es config region or AWS_REGION) is a valid AWS region code
3. Ensure server NTP clock sync — large clock skew breaks SigV4 signing
4. Retry transient cancellations; verify aws-sdk-go-v2 signer is correctly initialized and up to date

Example fix

// before (config missing/invalid region)
visibilityStore:
  esaws:
    enabled: true
    region: ""
// after
visibilityStore:
  esaws:
    enabled: true
    region: "us-east-1"

// validate region before constructing the signing client
if signingCfg.Region == "" {
    return fmt.Errorf("ES AWS signing requires a region")
}

resp, err := client.Do(req)
if err != nil && strings.Contains(err.Error(), "failed to sign request") {
    if errors.Is(req.Context().Err(), context.DeadlineExceeded) {
        // retry with a longer deadline
    }
    ...
}

When it happens

Trigger: SignHTTP fails when req.Context() is canceled or times out during signing, when the signing time/clock handling breaks, or when a non-fatal signer error surfaces for the configured service ('es') and region — for example signing with a region value that is invalid or missing.

Common situations: Server clock skewed so far that signing fails; empty/garbage region string passed via ESAWSRequestSigningConfig leading to signer errors; context deadlines canceled under load; misconfigured AWS SDK version mismatch in builds.

Related errors

• failed to read request body: %w
• failed to retrieve AWS credentials: %w
• unable to resolve AWS region for obtaining AWS Elastic signi
• unable to create AWS HTTP client for Elasticsearch: %w
• ErrUnableToExecuteActivity

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/811b987da8d81924. Report an issue: GitHub.