{"record":{"id":"d9a6b814de605e91","repo":"kubernetes/kops","slug":"aws-account-id-was-empty","errorCode":null,"errorMessage":"AWS account id was empty","messagePattern":"AWS account id was empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":2120,"sourceCode":"\treturn &resp.InstanceTypes[0], nil\n}\n\n// AccountInfo returns the AWS account ID and AWS partition that we are deploying into\nfunc (c *awsCloudImplementation) AccountInfo(ctx context.Context) (string, string, error) {\n\trequest := &sts.GetCallerIdentityInput{}\n\n\tresponse, err := c.sts.GetCallerIdentity(ctx, request)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"error getting AWS account ID: %v\", err)\n\t}\n\n\tarn, err := arn.Parse(aws.ToString(response.Arn))\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to parse GetCallerIdentity ARN: %w\", err)\n\t}\n\n\tif arn.AccountID == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS account id was empty\")\n\t}\n\tif arn.Partition == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"AWS partition was empty\")\n\t}\n\treturn arn.AccountID, arn.Partition, nil\n}\n\n// GetRolesInInstanceProfile return role names which are associated with the instance profile specified by profileName.\nfunc GetRolesInInstanceProfile(c AWSCloud, profileName string) ([]string, error) {\n\toutput, err := c.IAM().GetInstanceProfile(context.TODO(), &iam.GetInstanceProfileInput{\n\t\tInstanceProfileName: aws.String(profileName),\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tvar roleNames []string\n\tfor _, role := range output.InstanceProfile.Roles {\n\t\troleNames = append(roleNames, *role.RoleName)","sourceCodeStart":2102,"sourceCodeEnd":2138,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L2102-L2138","documentation":"kOps validates that the ARN returned by GetCallerIdentity carries a non-empty AccountID (aws_cloud.go:2120). The ARN parsed fine, but its account-id component is blank, so kOps cannot determine which AWS account it is deploying into. This guards against broken or synthetic STS responses before any resources are created.","triggerScenarios":"arn.Parse succeeded but arn.AccountID == \"\" — e.g. an ARN like 'arn:aws:iam:::user/x' with a missing account id, produced by a misbehaving STS-compatible endpoint, LocalStack, or an intercepted/proxied response.","commonSituations":"Using LocalStack or a corporate gateway that returns placeholder ARNs without account IDs; custom CA/proxy mangling the STS response; misconfigured endpoint override during kops create cluster.","solutions":["Verify real STS output: 'aws sts get-caller-identity' should show an Account field; if using a fake endpoint, fix or remove the endpoint override.","Update/reconfigure LocalStack (or the STS-mocking proxy) to return ARNs containing a 12-digit account ID.","Bypass any TLS-intercepting corporate proxy for sts.<region>.amazonaws.com and retry.","Re-run kOps with the standard AWS environment (no AWS_ENDPOINT_URL overrides) to confirm normal behavior."],"exampleFix":"// before (endpoint config)\nEndpointResolver: custom STS mock returning \"arn:aws:iam:::user/test\"\n// after\nEndpointResolver: nil  // default sts.<region>.amazonaws.com","handlingStrategy":"validation","validationCode":"// confirm the account component exists before calling AccountInfo-dependent code\nfunc arnHasAccount(arnStr string) bool {\n\tparsed, err := arn.Parse(arnStr)\n\treturn err == nil && parsed.AccountID != \"\"\n}\n// CLI equivalent: aws sts get-caller-identity --query Account --output text | grep -E '^[0-9]{12}$'","typeGuard":"func isEmptyAccountID(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"AWS account id was empty\")\n}","tryCatchPattern":"accountID, _, err := cloud.AccountInfo(ctx)\nif err != nil {\n\tif isEmptyAccountID(err) {\n\t\treturn fmt.Errorf(\"STS identity has no account ID; endpoint override or STS-compatible service misconfigured\")\n\t}\n\treturn err\n}","preventionTips":["Assert 'aws sts get-caller-identity' returns a 12-digit Account before provisioning.","Remove placeholder STS mocks/proxies (LocalStack, corporate gateways) from production paths.","Pin and test the AWS endpoint configuration used by kOps in CI.","Treat any STS response without a valid account ID as a broken environment, not a retryable error."],"tags":["aws","sts","arn","account-id"],"backgroundTag":"invalid-arn-format","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}