{"record":{"id":"99fa3d1f24383b98","repo":"kubernetes/kops","slug":"arn-q-contains-unexpected-number-of-colons","errorCode":null,"errorMessage":"arn %q contains unexpected number of colons","messagePattern":"arn %q contains unexpected number of colons","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":262,"sourceCode":"\tcallerIdentity, err := a.stsRequestValidator.getCallerIdentityV2(ctx, &a.client, &decoded)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn verifyCallerIdentity(ctx, callerIdentity)\n}\n\ntype verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)\n\nfunc (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {\n\tif callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {\n\t\treturn nil, fmt.Errorf(\"incorrect account %s\", callerIdentity.GetCallerIdentityResult[0].Account)\n\t}\n\n\tarn := callerIdentity.GetCallerIdentityResult[0].Arn\n\tparts := strings.Split(arn, \":\")\n\tif len(parts) != 6 {\n\t\treturn nil, fmt.Errorf(\"arn %q contains unexpected number of colons\", arn)\n\t}\n\tif parts[0] != \"arn\" {\n\t\treturn nil, fmt.Errorf(\"arn %q doesn't start with \\\"arn:\\\"\", arn)\n\t}\n\tif parts[1] != a.partition {\n\t\treturn nil, fmt.Errorf(\"arn %q not in partion %q\", arn, a.partition)\n\t}\n\tif parts[2] != \"iam\" && parts[2] != \"sts\" {\n\t\treturn nil, fmt.Errorf(\"arn %q has unrecognized service\", arn)\n\t}\n\t// parts[3] is region\n\t// parts[4] is account\n\tresource := strings.Split(parts[5], \"/\")\n\tif resource[0] != \"assumed-role\" {\n\t\treturn nil, fmt.Errorf(\"arn %q has unrecognized type\", arn)\n\t}\n\tif len(resource) < 3 {\n\t\treturn nil, fmt.Errorf(\"arn %q contains too few slashes\", arn)","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L244-L280","documentation":"Verification guard in verifyCallerIdentity: the caller ARN does not split into the expected 6 colon-separated ARN parts, so it cannot be parsed into partition/service/resource components for validation.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:262 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check for unusual ARN formats from STS","Verify the IAM role/identity configuration","Report odd ARNs to kOps maintainers"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}