{"record":{"id":"08dfdb478a040e44","repo":"kubernetes/kops","slug":"arn-q-not-in-partion-q","errorCode":null,"errorMessage":"arn %q not in partion %q","messagePattern":"arn %q not in partion %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":268,"sourceCode":"}\n\ntype verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)\n\nfunc (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {\n\tif callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {\n\t\treturn nil, fmt.Errorf(\"incorrect account %s\", callerIdentity.GetCallerIdentityResult[0].Account)\n\t}\n\n\tarn := callerIdentity.GetCallerIdentityResult[0].Arn\n\tparts := strings.Split(arn, \":\")\n\tif len(parts) != 6 {\n\t\treturn nil, fmt.Errorf(\"arn %q contains unexpected number of colons\", arn)\n\t}\n\tif parts[0] != \"arn\" {\n\t\treturn nil, fmt.Errorf(\"arn %q doesn't start with \\\"arn:\\\"\", arn)\n\t}\n\tif parts[1] != a.partition {\n\t\treturn nil, fmt.Errorf(\"arn %q not in partion %q\", arn, a.partition)\n\t}\n\tif parts[2] != \"iam\" && parts[2] != \"sts\" {\n\t\treturn nil, fmt.Errorf(\"arn %q has unrecognized service\", arn)\n\t}\n\t// parts[3] is region\n\t// parts[4] is account\n\tresource := strings.Split(parts[5], \"/\")\n\tif resource[0] != \"assumed-role\" {\n\t\treturn nil, fmt.Errorf(\"arn %q has unrecognized type\", arn)\n\t}\n\tif len(resource) < 3 {\n\t\treturn nil, fmt.Errorf(\"arn %q contains too few slashes\", arn)\n\t}\n\tfound := false\n\tfor _, role := range a.opt.NodesRoles {\n\t\tif resource[1] == role {\n\t\t\tfound = true\n\t\t\tbreak","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L250-L286","documentation":"Verification guard in verifyCallerIdentity: the ARN's partition component (e.g. aws, aws-cn) does not match the partition the verifier was configured for, so the identity comes from an unexpected AWS partition.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:268 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the verifier for the correct partition","Run the node in the matching partition","Check partition detection at verifier startup"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}