{"record":{"id":"e064ccb58db074e5","repo":"kubernetes/kops","slug":"building-v1-signed-request-w","errorCode":null,"errorMessage":"building (v1) signed request: %w","messagePattern":"building \\(v1\\) signed request: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/authenticator.go","lineNumber":127,"sourceCode":"\treturn a.createTokenV2(ctx, body)\n}\n\nfunc (a *awsAuthenticator) createTokenV1(ctx context.Context, body []byte) (string, error) {\n\tcredentials, err := a.credentialsProvider.Retrieve(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting AWS credentials: %w\", err)\n\t}\n\n\thost, err := a.getSTSHost(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting AWS STS url: %w\", err)\n\t}\n\tstsURL := \"https://\" + host + \"/\"\n\tregion := a.region\n\n\treq, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building (v1) signed request: %w\", err)\n\t}\n\theaders, err := json.Marshal(req.Header)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"converting headers to json: %w\", err)\n\t}\n\treturn AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil\n}\n\nfunc (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {\n\t// An inefficient but reliable way to get the STS url\n\tpresignClient := sts.NewPresignClient(a.sts)\n\tstsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"building AWS STS presigned request: %w\", err)\n\t}\n\tu, err := url.Parse(stsRequest.URL)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parsing AWS STS url: %w\", err)","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/authenticator.go#L109-L145","documentation":"createTokenV1 wraps a failure from signV1Request, which constructs an http.Request and signs it with AWS SigV4 (v4.NewSigner().SignHTTP) to produce the presigned GetCallerIdentity call. If request construction or signing fails, the v1 bootstrap token cannot be built.","triggerScenarios":"signV1Request(ctx, stsURL, region, credentials, time.Now(), body) returns an error during CreateToken (v1 path): bad STS URL, malformed credentials (empty access key), or an internal SigV4 signer failure.","commonSituations":"Empty region string causing SigV4 credential-scope errors; credentials retrieved with empty AccessKeyID; unit/integration tests stubbing the signer incorrectly; go aws-sdk-go-v2/features/ec2/imds or signer version incompatibilities after dependency upgrades.","solutions":["Check the region value passed to the authenticator is a valid AWS region string (non-empty, e.g. us-east-1).","Verify the retrieved credentials are non-empty (AccessKeyID/SecretAccessKey) before calling CreateToken.","Ensure the aws-sdk-go-v2 v4 signer package version matches the rest of the SDK modules in go.mod (run `make gomod`).","Re-run with verbose logging to see the underlying wrapped error from SignHTTP."],"exampleFix":"// before\nauth, _ := awsbootstrap.NewAuthenticator(ctx, \"\", stsClient, creds) // empty region\n// after\nauth, _ := awsbootstrap.NewAuthenticator(ctx, \"us-east-1\", stsClient, creds)","handlingStrategy":"try-catch","validationCode":"creds, err := credProvider.Retrieve(ctx)\nif err == nil && (creds.AccessKeyID == \"\" || creds.SecretAccessKey == \"\") {\n\treturn fmt.Errorf(\"incomplete AWS credentials\")\n}","typeGuard":null,"tryCatchPattern":"token, err := auth.CreateToken(body)\nif err != nil {\n\tif strings.Contains(err.Error(), \"building (v1) signed request\") {\n\t\t// inspect region + credentials, then retry after fixing config\n\t}\n}","preventionTips":["Pin aws-sdk-go-v2 module versions together in go.mod.","Validate region and credential non-emptiness before token creation.","Keep system time NTP-synced for SigV4."],"tags":["aws","sigv4","signing","bootstrap"],"backgroundTag":"aws-signing-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}