unable to resolve AWS region for obtaining AWS Elastic signi

Error message

unable to resolve AWS region for obtaining AWS Elastic signing credentials

What it means

NewAwsHttpClient builds the signing HTTP client for AWS OpenSearch/Elasticsearch visibility stores. SigV4 signing requires a region; if ESAWSRequestSigningConfig.Region is empty it falls back to the AWS_REGION environment variable, and when both are empty it refuses to construct the client with this error at visibility-store initialization time (via NewVisibilityStore).

Source

Thrown at common/persistence/visibility/store/elasticsearch/client/aws.go:65

	}

	if bodyBytes != nil {
		// set the request body just in case the signer consumes the body
		req.Body = io.NopCloser(bytes.NewReader(bodyBytes))
	}

	return t.wrapped.RoundTrip(req)
}

func NewAwsHttpClient(config ESAWSRequestSigningConfig) (*http.Client, error) {
	if !config.Enabled {
		return nil, nil
	}

	if config.Region == "" {
		config.Region = os.Getenv("AWS_REGION")
		if config.Region == "" {
			return nil, fmt.Errorf("unable to resolve AWS region for obtaining AWS Elastic signing credentials")
		}
	}

	var credsProvider aws.CredentialsProvider

	switch strings.ToLower(config.CredentialProvider) {
	case "static":
		credsProvider = credentials.NewStaticCredentialsProvider(
			config.Static.AccessKeyID,
			config.Static.SecretAccessKey,
			config.Static.Token,
		)
	case "environment":
		envConfig, err := awsconfig.NewEnvConfig()
		if err != nil {
			return nil, err
		}
		credsProvider = credentials.NewStaticCredentialsProvider(

View on GitHub (pinned to bde624efd1)

Solutions

Set the region in the visibility persistence config under the ES AWS request signing section
Export AWS_REGION in the service's environment if you prefer env-based configuration (AWS_DEFAULT_REGION is not consulted here)
Verify the rendered config template actually includes the region for this cluster/environment
Restart the frontend/history/worker services after adding the region — this error is fatal at store construction

Example fix

// before (persistence config)
visibilityStore:
  esaws:
    enabled: true
    credentialProvider: aws-sdk-default
// after
visibilityStore:
  esaws:
    enabled: true
    region: "us-west-2"
    credentialProvider: aws-sdk-default

Defensive patterns

Strategy: validation

Validate before calling

// startup-time pre-check
if cfg.Visibility.ESAWSRequestSigning.Enabled && cfg.Visibility.ESAWSRequestSigning.Region == "" && os.Getenv("AWS_REGION") == "" {
    return fmt.Errorf("AWS_REGION env or esaws.region config required for AWS ES signing")
}

Prevention

Always set region explicitly in the visibility store config rather than relying on env
Remember only AWS_REGION is checked — do not rely on AWS_DEFAULT_REGION alone
Add config validation to your deployment pipeline (rendered config lint)
Include the region in Helm/config templates per environment

When it happens

Trigger: Visibility persistence config enables ES AWS request signing (enabled: true) but omits the region field, and the process environment has no AWS_REGION set (note AWS_DEFAULT_REGION is NOT checked) — the error surfaces during NewVisibilityStore at service startup.

Common situations: Deploying Temporal with AWS-managed OpenSearch where the operator set credentials but forgot the region in the visibility store config; containers launched with only AWS_DEFAULT_REGION set instead of AWS_REGION; region dropped when templating config across environments.

Related errors

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/e558fd4679b57732. Report an issue: GitHub.