{"record":{"id":"459caf02746c38a4","repo":"kubernetes/kops","slug":"failed-to-parse-getcalleridentity-arn-w","errorCode":null,"errorMessage":"failed to parse GetCallerIdentity ARN: %w","messagePattern":"failed to parse GetCallerIdentity ARN: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":2116,"sourceCode":"\t}\n\tif len(resp.InstanceTypes) != 1 {\n\t\treturn nil, fmt.Errorf(\"instance type %q not found in region %q\", instanceType, c.Region())\n\t}\n\treturn &resp.InstanceTypes[0], nil\n}\n\n// AccountInfo returns the AWS account ID and AWS partition that we are deploying into\nfunc (c *awsCloudImplementation) AccountInfo(ctx context.Context) (string, string, error) {\n\trequest := &sts.GetCallerIdentityInput{}\n\n\tresponse, err := c.sts.GetCallerIdentity(ctx, request)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"error getting AWS account ID: %v\", err)\n\t}\n\n\tarn, err := arn.Parse(aws.ToString(response.Arn))\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to parse GetCallerIdentity ARN: %w\", err)\n\t}\n\n\tif arn.AccountID == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS account id was empty\")\n\t}\n\tif arn.Partition == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS partition was empty\")\n\t}\n\treturn arn.AccountID, arn.Partition, nil\n}\n\n// GetRolesInInstanceProfile return role names which are associated with the instance profile specified by profileName.\nfunc GetRolesInInstanceProfile(c AWSCloud, profileName string) ([]string, error) {\n\toutput, err := c.IAM().GetInstanceProfile(context.TODO(), &iam.GetInstanceProfileInput{\n\t\tInstanceProfileName: aws.String(profileName),\n\t})\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":2098,"sourceCodeEnd":2134,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L2098-L2134","documentation":"After a successful STS GetCallerIdentity, kOps parses response.Arn with github.com/aws/aws-sdk-go-v2/aws/arn (aws_cloud.go:2116). This error indicates the returned ARN string is empty or not a syntactically valid ARN. It signals an unexpected/nonstandard response from STS rather than a user configuration error.","triggerScenarios":"arn.Parse(aws.ToString(response.Arn)) fails because the Arn field is nil/empty, or the string does not match arn:partition:service:region:account-id:resource format — e.g. a mocked/faked STS endpoint, a nonstandard third-party S3-compatible/STS implementation (like MinIO or LocalStack misconfiguration), or a truncated response.","commonSituations":"Pointing kOps at a custom endpoint override (awsEndpointURL) for a service that returns non-ARN caller identity; LocalStack or similar fake AWS environment returning a malformed ARN; an SDK/response deserialization issue yielding a nil Arn.","solutions":["Inspect what sts get-caller-identity returns with the same endpoint/credentials; confirm the Arn field is a proper ARN.","Remove any custom STS endpoint overrides (AWS_ENDPOINT_URL, awsup endpoint config) unless intentionally using LocalStack/MinIO.","If using LocalStack, upgrade it so GetCallerIdentity returns a well-formed ARN like arn:aws:iam::123456789012:user/test.","Upgrade the AWS SDK / kOps if the response is genuinely valid but parsing fails (SDK version bug)."],"exampleFix":"// before (env)\nAWS_ENDPOINT_URL=http://old-sts-proxy:9999\n// after\nunset AWS_ENDPOINT_URL  # use real STS","handlingStrategy":"type-guard","validationCode":"// sanity-check the STS response shape before relying on it\nfunc validCallerIdentityARN(arnStr string) bool {\n\tif arnStr == \"\" { return false }\n\tparsed, err := arn.Parse(arnStr)\n\treturn err == nil && parsed.Service == \"sts\" && parsed.AccountID != \"\"\n}","typeGuard":"func isARNParseFailure(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"failed to parse GetCallerIdentity ARN\")\n}","tryCatchPattern":"accountID, partition, err := cloud.AccountInfo(ctx)\nif err != nil {\n\tif isARNParseFailure(err) {\n\t\treturn fmt.Errorf(\"STS returned a non-ARN caller identity; check for endpoint overrides (AWS_ENDPOINT_URL) or LocalStack misconfig: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Do not set AWS_ENDPOINT_URL or custom STS endpoint overrides in production kOps environments.","When using LocalStack, keep it updated so GetCallerIdentity returns a well-formed ARN.","Verify STS output with the AWS CLI before custom-tooling integrations.","Avoid TLS-intercepting proxies that can truncate or mangle API responses."],"tags":["aws","sts","arn","parsing"],"backgroundTag":"invalid-arn-format","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}