{"record":{"id":"cfe0207aa5f758c2","repo":"kubernetes/kops","slug":"failed-to-resolve-endpoint-v","errorCode":null,"errorMessage":"failed to resolve endpoint: %v","messagePattern":"failed to resolve endpoint: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/iam_builder.go","lineNumber":1522,"sourceCode":"// S3 (for SSE-KMS on the state-store bucket).\n//\n// Per AWS KMS docs the value is \"<service>.<region>.amazonaws.com\" — the\n// \".amazonaws.com\" suffix is used in all partitions (including aws-cn,\n// aws-us-gov, aws-iso, aws-iso-b); the partition-specific suffixes used for\n// service endpoints do NOT apply to kms:ViaService.\n// See: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html\n//\n// EC2 is pinned to the cluster's region (EBS is always in-region). S3 uses a\n// region wildcard because kops supports cross-region state-store buckets; the\n// caller must therefore evaluate the values under StringLike, not StringEquals.\n// IAMServiceEC2 returns the name of the IAM service for EC2 in the current region.\n// It is ec2.amazonaws.com in the default aws partition, but different in other isolated/custom partitions\nfunc IAMServiceEC2(region string) (string, error) {\n\tctx := context.TODO()\n\tresolver := ec2.NewDefaultEndpointResolverV2()\n\tep, err := resolver.ResolveEndpoint(ctx, ec2.EndpointParameters{Region: aws.String(region)})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to resolve endpoint: %v\", err)\n\t}\n\tif ep.URI.Host != \"\" {\n\t\t// Remove the region from the hostname. Examples:\n\t\t// ec2.us-east-1.amazonaws.com     -> ec2.amazonaws.com\n\t\t// ec2.cn-west-1.amazonaws.com.cn  -> ec2.amazonaws.com.cn\n\t\t// ec2.us-gov-west-1.amazonaws.com -> ec2.amazonaws.com\n\t\treturn strings.ReplaceAll(ep.URI.Host, fmt.Sprintf(\"%v.\", region), \"\"), nil\n\t}\n\treturn \"ec2.amazonaws.com\", nil\n}\n\nfunc kmsViaServices(region string) []string {\n\tif region == \"\" {\n\t\treturn nil\n\t}\n\treturn []string{\n\t\tfmt.Sprintf(\"ec2.%s.amazonaws.com\", region),\n\t\t\"s3.*.amazonaws.com\",","sourceCodeStart":1504,"sourceCodeEnd":1540,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/iam_builder.go#L1504-L1540","documentation":"Resolving the regional service endpoint used in kms:ViaService conditions failed while building the IAM policy; the AWS endpoint resolver could not map the service/region/partition combination for the cluster.","triggerScenarios":"Thrown at pkg/model/iam/iam_builder.go:1522 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the cluster's region is valid for the configured partition","Upgrade kops — the endpoint resolution data may be stale","Check for custom endpoint overrides in the environment"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}