{"record":{"id":"bcb7bc5bd4e0d114","repo":"gravitational/teleport","slug":"region-has-no-known-fips-endpoint","errorCode":null,"errorMessage":"region has no known FIPS endpoint","messagePattern":"region has no known FIPS endpoint","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/join/iam/iam.go","lineNumber":135,"sourceCode":"\t\t\tstsOpts.RetryMaxAttempts = 1\n\n\t\t\tstsOpts.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())\n\t\t})\n\n\tif _, err = stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}); !errors.Is(err, errRequestRecorded) {\n\t\tif err == nil {\n\t\t\treturn nil, trace.Errorf(\"expected to get errRequestRecorded, got <nil> (this is a bug)\")\n\t\t}\n\t\treturn nil, trace.Wrap(err, \"building signed sts:GetCallerIdentity request\")\n\t}\n\n\treturn signedRequest.Bytes(), nil\n}\n\nvar (\n\t// ErrNoFIPSEndpoint is returned when a FIPS endpoint is requested for a\n\t// region that has none.\n\tErrNoFIPSEndpoint = errors.New(\"region has no known FIPS endpoint\")\n)\n\n// ExpectedSTSHost returns the expected AWS STS endpoint hostname in the given region and FIPS mode.\nfunc ExpectedSTSHost(ctx context.Context, region string, fips bool) (string, error) {\n\t// This check is necessary because the AWS SDK will happily return FIPS\n\t// endpoints that don't exist in regions that don't have one.\n\tif fips && !slices.Contains(FIPSSTSRegions(), region) {\n\t\treturn \"\", ErrNoFIPSEndpoint\n\t}\n\tresolver := sts.NewDefaultEndpointResolverV2()\n\tendpoint, err := resolver.ResolveEndpoint(ctx, sts.EndpointParameters{\n\t\tRegion:  aws.String(region),\n\t\tUseFIPS: aws.Bool(fips),\n\t})\n\tif err != nil {\n\t\treturn \"\", trace.Wrap(err)\n\t}\n\treturn endpoint.URI.Hostname(), nil","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/join/iam/iam.go#L117-L153","documentation":"ErrNoFIPSEndpoint is returned by ExpectedSTSHost and validateSTSHost when a FIPS-mode AWS STS endpoint is requested for an AWS region that has no FIPS STS endpoint (checked against FIPSSTSRegions). The AWS SDK would otherwise happily produce a non-existent FIPS hostname, so Teleport fails early.","triggerScenarios":"Calling iam.ExpectedSTSHost(ctx, region, true) (or validateSTSHost with fips=true) for a region not in FIPSSTSRegions(); during IAM join, a node selects the FIPS STS endpoint while configured in such a region — the caller at lib/join/iamjoin/iam.go:115 converts it to AccessDenied.","commonSituations":"Teleport nodes provisioned in newer/opt-in AWS regions lacking FIPS endpoints attempting to join via the IAM method with FIPS mode enabled; misconfigured FIPS build assumptions in non-US regions.","solutions":["Move the joining node to an AWS region that has a FIPS STS endpoint (see FIPSSTSRegions for the supported set).","Disable FIPS mode for the join (so the standard STS endpoint is used) if FIPS STS is not required in that region.","In the join caller, handle errors.Is(err, iam.ErrNoFIPSEndpoint) with a clear AccessDenied message instructing the operator about region/FIPS compatibility."],"exampleFix":"// before\nexpectedSTSHost, err := iam.ExpectedSTSHost(ctx, region, true) // fips in unsupported region\n// after\nif fips && !slices.Contains(iam.FIPSSTSRegions(), region) {\n    return trace.BadParameter(\"region %q has no FIPS STS endpoint; disable FIPS or use a supported region\", region)\n}\nexpectedSTSHost, err := iam.ExpectedSTSHost(ctx, region, fips)","handlingStrategy":"validation","validationCode":"if fips && !slices.Contains(iam.FIPSSTSRegions(), region) {\n    return trace.BadParameter(\"region %q has no FIPS STS endpoint\", region)\n}","typeGuard":"if errors.Is(err, iam.ErrNoFIPSEndpoint) { /* unsupported region for FIPS STS */ }","tryCatchPattern":"expectedSTSHost, err := iam.ExpectedSTSHost(ctx, region, fips)\nif errors.Is(err, iam.ErrNoFIPSEndpoint) {\n    return trace.AccessDenied(\"node selected FIPS AWS STS endpoint in region with no known FIPS endpoint\")\n}","preventionTips":["Check the region against FIPSSTSRegions before enabling FIPS mode on joining nodes.","Standardize joining nodes in AWS regions with FIPS STS endpoints.","Make FIPS a deliberate config flag so non-US regions don't silently request FIPS endpoints."],"tags":["aws","fips","iam-join","sts"],"backgroundTag":"fips-endpoint-unsupported-region","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}