{"record":{"id":"b6aed79bb2bcebcc","repo":"kubernetes/kops","slug":"building-aws-sts-presigned-request-w","errorCode":null,"errorMessage":"building AWS STS presigned request: %w","messagePattern":"building AWS STS presigned request: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":141,"sourceCode":"\tregion := a.region\n\n\treq, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building (v1) signed request: %w\", err)\n\t}\n\theaders, err := json.Marshal(req.Header)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"converting headers to json: %w\", err)\n\t}\n\treturn AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil\n}\n\nfunc (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {\n\t// An inefficient but reliable way to get the STS url\n\tpresignClient := sts.NewPresignClient(a.sts)\n\tstsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building AWS STS presigned request: %w\", err)\n\t}\n\tu, err := url.Parse(stsRequest.URL)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parsing AWS STS url: %w\", err)\n\t}\n\treturn u.Host, err\n}\n\nfunc (a *awsAuthenticator) createTokenV2(ctx context.Context, body []byte) (string, error) {\n\tsha := sha256.Sum256(body)\n\n\tpresignClient := sts.NewPresignClient(a.sts)\n\n\t// Ensure the signature is only valid for this particular body content.\n\tstsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}, func(po *sts.PresignOptions) {\n\t\tpo.ClientOptions = append(po.ClientOptions, func(o *sts.Options) {\n\t\t\to.APIOptions = append(o.APIOptions, smithyhttp.AddHeaderValue(\"X-Kops-Request-SHA\", base64.RawStdEncoding.EncodeToString(sha[:])))\n\t\t})","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L123-L159","documentation":"getSTSHost wraps a failure from the STS presign client building a presigned GetCallerIdentity request, used to discover the regional STS hostname. Presigning happens locally (no network call) but still requires valid credentials and client configuration, so it fails when either is unusable.","triggerScenarios":"PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}) errors inside getSTSHost, which is called by createTokenV1 during CreateToken: credentials cannot be resolved for signing, or the sts.Client is misconfigured/nil-adjacent options are invalid.","commonSituations":"Expired credentials at presign time; STS client created with an invalid region or endpoint; a lambda/container env where the credentials chain has not populated yet at startup; SDK version skew between sts and credentials modules after `go mod` upgrades.","solutions":["Validate credentials are retrievable before calling CreateToken (e.g. `aws sts get-caller-identity`).","Rebuild the sts.Client via sts.NewFromConfig(config.LoadDefaultConfig(ctx, config.WithRegion(\"<region>\"))).","If running in EKS/ECS, confirm the pod/task role is assumed and the credentials process has finished before bootstrap.","Pin aws-sdk-go-v2 module versions consistently across go.mod and re-run `make gomod`."],"exampleFix":"// before: client without region\nstsc := sts.NewFromConfig(cfg)\n// after: explicit region so presign resolves a real STS endpoint\ncfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion(\"eu-west-1\"))\nstsc := sts.NewFromConfig(cfg)","handlingStrategy":"retry","validationCode":"creds, err := credProvider.Retrieve(ctx)\nif err != nil {\n\treturn fmt.Errorf(\"resolve credentials before presigning: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"for attempt := 0; attempt < 3; attempt++ {\n\tif _, err := auth.CreateToken(body); err == nil { break }\n\ttime.Sleep(time.Duration(1<<attempt) * time.Second) // creds may still be initializing\n}","preventionTips":["Wait for pod/task credentials to be ready before bootstrap at startup.","Keep SDK modules version-aligned.","Confirm instance/pod IAM role attachment before running kOps."],"tags":["aws","sts","presign","bootstrap"],"backgroundTag":"aws-presign-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}