{"record":{"id":"108a9d170136ca02","repo":"kubernetes/kops","slug":"error-getting-aws-account-id-v","errorCode":null,"errorMessage":"error getting AWS account ID: %v","messagePattern":"error getting AWS account ID: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":2111,"sourceCode":"\t\tInstanceTypes: []ec2types.InstanceType{ec2types.InstanceType(instanceType)},\n\t}\n\tresp, err := c.EC2().DescribeInstanceTypes(ctx, req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"describing instance type %q in region %q: %w\", instanceType, c.Region(), err)\n\t}\n\tif len(resp.InstanceTypes) != 1 {\n\t\treturn nil, fmt.Errorf(\"instance type %q not found in region %q\", instanceType, c.Region())\n\t}\n\treturn &resp.InstanceTypes[0], nil\n}\n\n// AccountInfo returns the AWS account ID and AWS partition that we are deploying into\nfunc (c *awsCloudImplementation) AccountInfo(ctx context.Context) (string, string, error) {\n\trequest := &sts.GetCallerIdentityInput{}\n\n\tresponse, err := c.sts.GetCallerIdentity(ctx, request)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"error getting AWS account ID: %v\", err)\n\t}\n\n\tarn, err := arn.Parse(aws.ToString(response.Arn))\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to parse GetCallerIdentity ARN: %w\", err)\n\t}\n\n\tif arn.AccountID == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS account id was empty\")\n\t}\n\tif arn.Partition == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS partition was empty\")\n\t}\n\treturn arn.AccountID, arn.Partition, nil\n}\n\n// GetRolesInInstanceProfile return role names which are associated with the instance profile specified by profileName.\nfunc GetRolesInInstanceProfile(c AWSCloud, profileName string) ([]string, error) {","sourceCodeStart":2093,"sourceCodeEnd":2129,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L2093-L2129","documentation":"kOps' AccountInfo calls STS GetCallerIdentity to determine the AWS account ID and partition being deployed into (aws_cloud.go:2111). This error wraps any failure of that STS call. Since GetCallerIdentity is the canonical credential probe, this almost always signals an authentication, permission, or connectivity problem with AWS.","triggerScenarios":"c.sts.GetCallerIdentity returns an error: no credentials found, invalid/expired credentials, STS endpoint unreachable, IAM policy denies sts:GetCallerIdentity (rare), or clock skew causing signature rejection.","commonSituations":"AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY not set or wrong; assuming a role fails (missing trust or source identity); corporate proxy blocking sts.<region>.amazonaws.com; system clock skew on the machine breaking SigV4 signatures; wrong region endpoint configured.","solutions":["Run 'aws sts get-caller-identity' with the same credentials/profile to reproduce; fix credentials (env vars, ~/.aws/credentials, or instance profile).","If role assumption is involved, verify the role ARN and trust policy; re-run 'aws sts assume-role' manually.","Check network access to the STS endpoint (proxy settings, HTTPS_PROXY, VPC endpoints).","Sync the system clock (chrony/ntp) if the error mentions RequestTimeTooSkewed.","Ensure AWS_REGION / AWS_DEFAULT_REGION is set to a valid region."],"exampleFix":"// before\nexport AWS_ACCESS_KEY_ID=old-expired-key\n// after\naws sso login && export AWS_PROFILE=dev-admin","handlingStrategy":"validation","validationCode":"// preflight credential check before running kOps\nfunc checkAWSCredentials(ctx context.Context, cfg aws.Config) error {\n\t_, err := cfg.Credentials.Retrieve(ctx)\n\treturn err // fails fast with clear message if no valid credentials\n}","typeGuard":"func isCredentialError(err error) bool {\n\tvar ce *aws.CredentialsCacheError\n\tif errors.As(err, &ce) { return true }\n\treturn err != nil && (strings.Contains(err.Error(), \"no EC2 IMDS role found\") ||\n\t\tstrings.Contains(err.Error(), \"failed to retrieve credentials\") ||\n\t\tstrings.Contains(err.Error(), \"InvalidClientTokenId\"))\n}","tryCatchPattern":"accountID, partition, err := cloud.AccountInfo(ctx)\nif err != nil {\n\tif isCredentialError(err) {\n\t\treturn fmt.Errorf(\"AWS credentials invalid or missing: run 'aws sts get-caller-identity' to diagnose: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Run 'aws sts get-caller-identity' as a preflight step in scripts/CI before kOps commands.","Use a single credential source (profile, SSO, or instance role) and avoid mixing expired static keys.","Keep system clocks synchronized (NTP) — SigV4 fails on skew.","Set AWS_REGION/AWS_DEFAULT_REGION explicitly and verify STS endpoint reachability behind proxies."],"tags":["aws","sts","authentication","credentials"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}