Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Credential should be scoped to a valid region, not 'aws-global'

See original GitHub issue

Long story short, I’m trying to migrate a project from software.amazon.awssdk:bom:2.0.0-preview-12 to software.amazon.awssdk:bom:2.2.0 and the approach for picking up credentials, that used to work, now ends up failing with SdkClientException, which is caused by Credential should be scoped to a valid region, not 'aws-global' in the AwsCredentialsProviderChain.

Context

We are using aws-okta to generate .aws/config / .aws/credentials, and it used to be enough to set AWS_PROFILE environment variable, to allow the application to pick up the credentials. The application in question is only using S3 client.

Current Behavior

In 2.2.0 (and looks like this behavior started from 2.0.0-preview-13) it’s now mandatory to provide region in the .aws/config, and it does not matter if it’s going to be a totally different region from the one where our S3 buckets are in. If region is not set on the profile, the following exception is thrown by the client:

Exception in thread "main" software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(), EnvironmentVariableCredentialsProvider(), ProfileCredentialsProvider(profileName=..., profileFile=ProfileFile(profiles=[Profile(name=..., properties=[role_name, source_profile, role_arn]), Profile(name=..., properties=[role_name, source_profile, role_arn]), Profile(name=default, properties=[output, aws_access_key_id, aws_session_token, aws_secret_access_key])])), ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) : [SystemPropertyCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., ProfileCredentialsProvider(profileName=...., profileFile=ProfileFile(profiles=[Profile(name=..., properties=[role_name, source_profile, role_arn]), Profile(name=..., properties=[role_name, source_profile, role_arn]), Profile(name=default, properties=[output, aws_access_key_id, aws_session_token, aws_secret_access_key])])): Credential should be scoped to a valid region, not 'aws-global'.  (Service: Sts, Status Code: 403, Request ID: ...), ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Unable to load credentials from service endpoint.]
	at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:97)
	at software.amazon.awssdk.auth.credentials.AwsCredentialsProviderChain.resolveCredentials(AwsCredentialsProviderChain.java:112)
	at software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider.resolveCredentials(DefaultCredentialsProvider.java:92)
	at software.amazon.awssdk.awscore.client.handler.AwsClientHandlerUtils.createExecutionContext(AwsClientHandlerUtils.java:70)
	at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.createExecutionContext(AwsSyncClientHandler.java:68)
	at software.amazon.awssdk.core.client.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:54)
	at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:51)
	at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:62)
	at software.amazon.awssdk.services.s3.DefaultS3Client.getObject(DefaultS3Client.java:1597)
	at software.amazon.awssdk.services.s3.S3Client.getObject(S3Client.java:2292)
...

Expected Behavior

I would expect the SDK to work the same way as aws-cli does. (E.g. I can call run aws s3 ls --profile=... s3://... without needing to specify the region).