{"record":{"id":"7e98b8c4801bfc36","repo":"kubernetes/kops","slug":"arn-q-doesn-t-start-with-arn","errorCode":null,"errorMessage":"arn %q doesn't start with \"arn:\"","messagePattern":"arn %q doesn't start with \"arn:\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":265,"sourceCode":"\t}\n\n\treturn verifyCallerIdentity(ctx, callerIdentity)\n}\n\ntype verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)\n\nfunc (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {\n\tif callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {\n\t\treturn nil, fmt.Errorf(\"incorrect account %s\", callerIdentity.GetCallerIdentityResult[0].Account)\n\t}\n\n\tarn := callerIdentity.GetCallerIdentityResult[0].Arn\n\tparts := strings.Split(arn, \":\")\n\tif len(parts) != 6 {\n\t\treturn nil, fmt.Errorf(\"arn %q contains unexpected number of colons\", arn)\n\t}\n\tif parts[0] != \"arn\" {\n\t\treturn nil, fmt.Errorf(\"arn %q doesn't start with \\\"arn:\\\"\", arn)\n\t}\n\tif parts[1] != a.partition {\n\t\treturn nil, fmt.Errorf(\"arn %q not in partion %q\", arn, a.partition)\n\t}\n\tif parts[2] != \"iam\" && parts[2] != \"sts\" {\n\t\treturn nil, fmt.Errorf(\"arn %q has unrecognized service\", arn)\n\t}\n\t// parts[3] is region\n\t// parts[4] is account\n\tresource := strings.Split(parts[5], \"/\")\n\tif resource[0] != \"assumed-role\" {\n\t\treturn nil, fmt.Errorf(\"arn %q has unrecognized type\", arn)\n\t}\n\tif len(resource) < 3 {\n\t\treturn nil, fmt.Errorf(\"arn %q contains too few slashes\", arn)\n\t}\n\tfound := false\n\tfor _, role := range a.opt.NodesRoles {","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L247-L283","documentation":"verifyCallerIdentity splits the STS-reported ARN on ':' and requires 6 colon-separated parts; this guard fires when the ARN does not begin with the literal 'arn'. It validates that GetCallerIdentity returned a well-formed ARN for the requesting node before extracting account/partition.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:265 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify STS returned a standard ARN","Check identity configuration","Report malformed ARNs to maintainers"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}