{"record":{"id":"7c99f244d3b24f50","repo":"kubernetes/kops","slug":"unexpected-signature-value","errorCode":null,"errorMessage":"unexpected signature value","messagePattern":"unexpected signature value","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":199,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"incorrect authorization format\")\n\t\t}\n\t\tgot := kv[1]\n\t\tswitch kv[0] {\n\t\tcase \"Signature\":\n\t\t\tamzSignature = got\n\t\tcase \"Credential\":\n\t\t\tamzCredential = got\n\t\tcase \"SignedHeaders\":\n\t\t\tamzSignedHeaders = got\n\t\t}\n\t}\n\tsignedHeaders := sets.New(strings.Split(amzSignedHeaders, \";\")...)\n\tif !signedHeaders.Has(\"x-kops-request-sha\") {\n\t\treturn nil, fmt.Errorf(\"unexpected signed headers value\")\n\t}\n\n\tif amzSignature == \"\" {\n\t\treturn nil, fmt.Errorf(\"unexpected signature value\")\n\t}\n\tif amzCredential == \"\" {\n\t\treturn nil, fmt.Errorf(\"unexpected credential value\")\n\t}\n\n\tcallerIdentity, err := a.stsRequestValidator.getCallerIdentityV1(ctx, &a.client, decoded)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn verifyCallerIdentity(ctx, callerIdentity)\n}\n\nfunc (a awsVerifier) verifyTokenV2(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {\n\ttoken = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV2)\n\n\ttokenBytes, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil {","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L181-L217","documentation":"verifyTokenV1 parses the SigV4 Authorization components (Signature, Credential, SignedHeaders); after confirming x-kops-request-sha is among the signed headers, it requires a non-empty Signature. This error means the token's authorization header lacked the Signature element, so the request cannot be verified against STS.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:199 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the presigned STS URL with a signature","Check token truncation in transit","Use matching kOps versions"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}