{"record":{"id":"19039849e9aa938d","repo":"kubernetes/kops","slug":"aws-partition-was-empty","errorCode":null,"errorMessage":"AWS partition was empty","messagePattern":"AWS partition was empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":2123,"sourceCode":"// AccountInfo returns the AWS account ID and AWS partition that we are deploying into\nfunc (c *awsCloudImplementation) AccountInfo(ctx context.Context) (string, string, error) {\n\trequest := &sts.GetCallerIdentityInput{}\n\n\tresponse, err := c.sts.GetCallerIdentity(ctx, request)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"error getting AWS account ID: %v\", err)\n\t}\n\n\tarn, err := arn.Parse(aws.ToString(response.Arn))\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to parse GetCallerIdentity ARN: %w\", err)\n\t}\n\n\tif arn.AccountID == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS account id was empty\")\n\t}\n\tif arn.Partition == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS partition was empty\")\n\t}\n\treturn arn.AccountID, arn.Partition, nil\n}\n\n// GetRolesInInstanceProfile return role names which are associated with the instance profile specified by profileName.\nfunc GetRolesInInstanceProfile(c AWSCloud, profileName string) ([]string, error) {\n\toutput, err := c.IAM().GetInstanceProfile(context.TODO(), &iam.GetInstanceProfileInput{\n\t\tInstanceProfileName: aws.String(profileName),\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tvar roleNames []string\n\tfor _, role := range output.InstanceProfile.Roles {\n\t\troleNames = append(roleNames, *role.RoleName)\n\t}\n\treturn roleNames, nil\n}","sourceCodeStart":2105,"sourceCodeEnd":2141,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L2105-L2141","documentation":"This error is thrown by the ARN-parsing helper in awsup when an ARN parsed into its account ID and partition yields an empty partition. The library treats an ARN without a partition as malformed because the partition (aws, aws-cn, aws-us-gov) is required to construct correct service endpoints and identify the account's environment. It is a defensive validation immediately after ARN parsing.","triggerScenarios":"Calling the helper that splits an ARN into (accountID, partition) with an ARN string that either is not a valid ARN or whose arn:partition:segment is missing/empty, so the parsed ARN.Partition field is the empty string.","commonSituations":"Passing a malformed IAM role or instance-profile ARN in cluster config (typos like 'arn:aws::123456789012:role/foo' with missing fields), environment variables or kops flags holding placeholder values like empty strings, or copy-pasted ARNs from other clouds/docs that were never valid.","solutions":["Verify the ARN string in your cluster spec / flag / env var is a complete valid ARN of the form arn:partition:service:region:account-id:resource","Fix typos where the partition segment is missing or empty (e.g. arn:aws:iam::123456789012:role/name)","Confirm the resource actually exists with the AWS CLI (aws iam get-role / aws sts get-caller-identity) so you copy a real ARN"],"exampleFix":"// before\nKOPS_STATE_STORE_ARN=\"arn:aws:iam::123456789012:role/\"  // truncated ARN\n// after\nKOPS_STATE_STORE_ARN=\"arn:aws:iam::123456789012:role/kops-state-store\"","handlingStrategy":"validation","validationCode":"// validate ARN shape before use\nvar arnRe = regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):[a-z0-9-]*:[a-z0-9-]*:[0-9]{0,12}:.+$`)\nfunc validARN(arn string) bool { return arnRe.MatchString(arn) }","typeGuard":"func isARNPartitionPresent(parsedArn arn.ARN) bool {\n    return parsedArn.Partition != \"\" && parsedArn.AccountID != \"\"\n}","tryCatchPattern":"acct, part, err := ParseARN(arnStr)\nif err != nil {\n    return fmt.Errorf(\"invalid ARN %q: %w\", arnStr, err)\n}","preventionTips":["Copy ARNs directly from `aws iam get-role` / `aws sts get-caller-identity` output instead of typing them","Validate ARNs with a regex or arn.Parse before storing them in cluster config","Lint cluster manifests for empty ARN segments"],"tags":["aws","arn","validation","config"],"backgroundTag":"invalid-arn","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}