{"record":{"id":"9fea72db6eef9e14","repo":"kubernetes/kops","slug":"incorrect-account-s","errorCode":null,"errorMessage":"incorrect account %s","messagePattern":"incorrect account (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":256,"sourceCode":"\t}\n\n\tif !a.stsRequestValidator.isValidV2(reqURL) {\n\t\treturn nil, fmt.Errorf(\"invalid STS url: host=%q, path=%q\", reqURL.Host, reqURL.Path)\n\t}\n\n\tcallerIdentity, err := a.stsRequestValidator.getCallerIdentityV2(ctx, &a.client, &decoded)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn verifyCallerIdentity(ctx, callerIdentity)\n}\n\ntype verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)\n\nfunc (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {\n\tif callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {\n\t\treturn nil, fmt.Errorf(\"incorrect account %s\", callerIdentity.GetCallerIdentityResult[0].Account)\n\t}\n\n\tarn := callerIdentity.GetCallerIdentityResult[0].Arn\n\tparts := strings.Split(arn, \":\")\n\tif len(parts) != 6 {\n\t\treturn nil, fmt.Errorf(\"arn %q contains unexpected number of colons\", arn)\n\t}\n\tif parts[0] != \"arn\" {\n\t\treturn nil, fmt.Errorf(\"arn %q doesn't start with \\\"arn:\\\"\", arn)\n\t}\n\tif parts[1] != a.partition {\n\t\treturn nil, fmt.Errorf(\"arn %q not in partion %q\", arn, a.partition)\n\t}\n\tif parts[2] != \"iam\" && parts[2] != \"sts\" {\n\t\treturn nil, fmt.Errorf(\"arn %q has unrecognized service\", arn)\n\t}\n\t// parts[3] is region\n\t// parts[4] is account","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L238-L274","documentation":"Verification guard in verifyCallerIdentity: the AWS account returned by STS GetCallerIdentity does not match the account the verifier is configured to trust, so the node belongs to a different AWS account and is rejected.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:256 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run the node in the expected AWS account","Configure the verifier with the correct account ID","Check for cross-account confusion in the setup"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}