{"record":{"id":"789520b98f58d3a0","repo":"kubernetes/kops","slug":"getting-aws-sts-url-w","errorCode":null,"errorMessage":"getting AWS STS url: %w","messagePattern":"getting AWS STS url: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":120,"sourceCode":"\t// and nodes at much higher versions is not guaranteed to be supported by kube,\n\t// so once we are at kOps 1.32 this shoud be safe to flip to use V2.\n\t// It's possibly safe at kOps 1.31 but that might need more careful analysis.\n\tsignWithV1 := true\n\tif signWithV1 {\n\t\treturn a.createTokenV1(ctx, body)\n\t}\n\treturn a.createTokenV2(ctx, body)\n}\n\nfunc (a *awsAuthenticator) createTokenV1(ctx context.Context, body []byte) (string, error) {\n\tcredentials, err := a.credentialsProvider.Retrieve(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting AWS credentials: %w\", err)\n\t}\n\n\thost, err := a.getSTSHost(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting AWS STS url: %w\", err)\n\t}\n\tstsURL := \"https://\" + host + \"/\"\n\tregion := a.region\n\n\treq, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building (v1) signed request: %w\", err)\n\t}\n\theaders, err := json.Marshal(req.Header)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"converting headers to json: %w\", err)\n\t}\n\treturn AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil\n}\n\nfunc (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {\n\t// An inefficient but reliable way to get the STS url\n\tpresignClient := sts.NewPresignClient(a.sts)","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L102-L138","documentation":"createTokenV1 wraps a failure from getSTSHost, which resolves the regional STS endpoint hostname by building a presigned GetCallerIdentity request. If the presign call fails, the authenticator cannot determine the STS URL to sign against, so the v1 token creation aborts.","triggerScenarios":"a.getSTSHost(ctx) errors inside CreateToken (v1 path): sts.NewPresignClient(a.sts).PresignGetCallerIdentity fails due to nil/misconfigured STS client, invalid region, or SDK client construction failure.","commonSituations":"STS client built with an unknown/unsupported region name; AWS SDK config LoadDefaultConfig failed silently producing a client with no region; endpoint override pointing to an unreachable custom STS endpoint; SDK version mismatch in sts options.","solutions":["Confirm the STS client passed to the authenticator was built with a valid AWS region (AWS_REGION or config option WithRegion).","Run `aws sts get-caller-identity --region <region>` to confirm the regional STS endpoint resolves from this machine.","Check for a custom BaseEndpoint/endpoint override on the sts.Client that may be wrong or unreachable.","Regenerate the sts.Client from a fresh config.LoadDefaultConfig call with proper credential/region options."],"exampleFix":"// before\ncfg, _ := config.LoadDefaultConfig(ctx)\nstsc := sts.NewFromConfig(cfg) // region may be empty\n// after\ncfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion(\"us-east-1\"))\nstsc := sts.NewFromConfig(cfg)","handlingStrategy":"validation","validationCode":"if cfg.Region == \"\" {\n\treturn fmt.Errorf(\"AWS region must be set (AWS_REGION or config.WithRegion)\")\n}","typeGuard":null,"tryCatchPattern":"host, err := a.getSTSHost(ctx)\nif err != nil {\n\treturn fmt.Errorf(\"cannot resolve STS endpoint, check region config: %w\", err)\n}","preventionTips":["Always set AWS_REGION explicitly for the cluster's region.","Test regional STS reachability with aws CLI before running kOps.","Avoid custom BaseEndpoint overrides unless required."],"tags":["aws","sts","region","bootstrap"],"backgroundTag":"aws-sts-endpoint-unresolvable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}