aws-sdk-go: NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors

Please fill out the sections below to help us address your issue.

Version of AWS SDK for Go?

v1.25.13

Version of Go (`go version`)?

1.13.1

What issue did you see?

I’m using ElasticBeanstalk and some requests fail with:

NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors

Steps to reproduce

This issue is hard to reproduce, happens infrequently, for a small fraction of requests. There can be days of it not happening, but if it starts occurring, there is a spike of these errors.

I also noticed that when the load on an instance increases, the likelihood of this error also increases.

I’m using the worker type of EBS.

Please let me know what additional information is required from me to fix this.

UPDATE: I enabled Verbose logging for credentials and here is the full error message:

NoCredentialProviders: no valid providers in chain
caused by: EnvAccessKeyNotFound: failed to find credentials in the environment.
SharedCredsLoad: failed to load profile, .
EC2RoleRequestError: no EC2 instance role found
caused by: RequestError: send request failed
caused by: Get http://169.254.169.254/latest/meta-data/iam/security-credentials/: dial tcp 169.254.169.254:80: connect: connection refused

This is related to: https://github.com/aws/aws-sdk-go/issues/1861

About this issue

Original URL
State: closed
Created 5 years ago
Reactions: 36
Comments: 17 (2 by maintainers)

Commits related to this issue

PLTFRS-10378: update aws-sdk-go to the latest version Hopefully this will help prevent random authentication errors. See https://github.com/aws/aws-sdk-go/issues/2914#issuecomment-578392465 — committed to AirVantage/overlord by oliwer 4 years ago
PLTFRS-10378 Subnet Scanning and IPv6 support (#3) * PLTFRS-10378: Switch to Go Modules * PLTFRS-10378: Move the IP lookup stuff in a separate module * Add support for Subnet lookups * Add IPv... — committed to AirVantage/overlord by oliwer 4 years ago

Most upvoted comments

NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors

👋 Hiyo! I encountered this and related errors while attempting to configure Traefik in a Docker Swarm to manage Let’s Encrypt certificates. Traefik uses lego which uses this Go SDK. Noting my findings here in case it’ll help others affected by this.

Problem:

In my case I had written my AWS key and key ID in secrets which made them available in files at /run/secrets/<secret>. And I configured AWS_ACCESS_KEY_ID_FILE and AWS_SECRET_ACCESS_KEY_FILE with paths to those files.

As the lego doc indicates, though, those _FILE variables are not supported for Route53. And I do not want to pass the key and key ID as environment variables.

Solution:

Following this hint from AWS I created an AWS credentials file as a secret:

[default]
aws_access_key_id = <YOUR_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_SECRET_ACCESS_KEY>

And set AWS_SHARED_CREDENTIALS_FILE to the path of that file, in my docker-compose file:

environment:
  - AWS_SHARED_CREDENTIALS_FILE=/run/secrets/<NAME_OF_SECRET>

solvaholic on Jun 25, 2020

I have the same error while accessing DynamoDB. Go version v1.12, aws-sdk-go version v1.25.42

It doesn’t seem to be load dependent, since sometimes it happens on 600+ RPS.

Region is EUC1 as well. We run our code in Kubernetes. We use m5.lagre as our Kubernetes nodes.

dmigo on Jan 20, 2020

I am also getting this error after compiling the program to a binary go version go1.14.2 linux/amd64

ykcab on May 28, 2020