{"record":{"id":"2046f42d35b2e92c","repo":"getsops/sops","slug":"failed-to-construct-sts-session-name-w","errorCode":null,"errorMessage":"failed to construct STS session name: %w","messagePattern":"failed to construct STS session name: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kms/keysource.go","lineNumber":465,"sourceCode":"\tclient := sts.NewFromConfig(*config)\n\tout, err := client.AssumeRole(ctx, input)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to assume role '%s': %w\", key.Role, err)\n\t}\n\n\tconfig.Credentials = credentials.NewStaticCredentialsProvider(*out.Credentials.AccessKeyId,\n\t\t*out.Credentials.SecretAccessKey, *out.Credentials.SessionToken,\n\t)\n\treturn config, nil\n}\n\n// stsSessionName returns the name for the STS session in the format of\n// `sops@<hostname>`. It sanitizes the hostname with stsSessionRegex, and\n// truncates to roleSessionNameLengthLimit when it exceeds the limit.\nfunc stsSessionName() (string, error) {\n\thostname, err := osHostname()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to construct STS session name: %w\", err)\n\t}\n\n\tre := regexp.MustCompile(stsSessionRegex)\n\tsanitizedHostname := re.ReplaceAllString(hostname, \"\")\n\n\tname := \"sops@\" + sanitizedHostname\n\tif len(name) >= roleSessionNameLengthLimit {\n\t\tname = name[:roleSessionNameLengthLimit]\n\t}\n\treturn name, nil\n}\n\nfunc stringPointerToStringMap(in map[string]*string) map[string]string {\n\tvar out = make(map[string]string)\n\tfor k, v := range in {\n\t\tif v == nil {\n\t\t\tcontinue\n\t\t}","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/kms/keysource.go#L447-L483","documentation":"Before assuming a role, sops builds a session name `sops@<hostname>` and needs the machine hostname via osHostname(). If the OS hostname lookup fails, this error wraps that failure. It is rare and almost always indicates a broken local hostname resolution on the machine.","triggerScenarios":"EncryptContext/DecryptContext with a KMS key that has a Role set, causing createSTSConfig to call stsSessionName, when os.Hostname() returns an error (e.g. host name not set, /proc/sys/kernel/hostname unreadable, or in odd container sandboxes).","commonSituations":"Containers or chroots where the hostname is unset or /etc/hostname is missing; restricted environments where syscalls to get the hostname fail.","solutions":["Fix the machine hostname: run `hostname` to check; if empty, set it (e.g. `sudo hostnamectl set-hostname myhost` or docker run --hostname).","Ensure /etc/hostname (Linux) exists and is readable, and the hostname is resolvable.","As a workaround in ephemeral sandboxes, set the container hostname explicitly at launch.","Retry after fixing; the error is deterministic until hostname lookup succeeds."],"exampleFix":"// before\n$ docker run --rm sops-image  # hostname may be a random hash or lookup may fail\n// after\n$ docker run --rm --hostname sops-runner sops-image","handlingStrategy":"validation","validationCode":"// Go\nif _, err := os.Hostname(); err != nil {\n  return fmt.Errorf(\"hostname unavailable; STS session name cannot be built: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// Go\nif err != nil && strings.Contains(err.Error(), \"failed to construct STS session name\") {\n  return fmt.Errorf(\"fix machine hostname (hostnamectl set-hostname or --hostname) before retrying: %w\", err)\n}","preventionTips":["Set an explicit hostname on containers (docker run --hostname / k8s hostname fields)","Ensure /etc/hostname exists and is readable in minimal images","Check `hostname` works as part of environment smoke tests in CI"],"tags":["aws","sts","hostname","environment"],"backgroundTag":"hostname-lookup-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}