{"record":{"id":"e548ed1ec1e41e44","repo":"kubernetes/kops","slug":"service-account-name-cannot-contain-a-wildcard-s","errorCode":null,"errorMessage":"service account name cannot contain a wildcard %s","messagePattern":"service account name cannot contain a wildcard (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/iam.go","lineNumber":408,"sourceCode":"\nfunc (b *IAMModelBuilder) buildPolicy(policyString string) (*iam.Policy, error) {\n\tp := &iam.Policy{\n\t\tVersion: iam.PolicyDefaultVersion,\n\t}\n\n\tstatements, err := iam.ParseStatements(policyString)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tp.Statement = append(p.Statement, statements...)\n\treturn p, nil\n}\n\nfunc formatAWSIAMStatement(accountId, partition, oidcProvider, namespace, name string) (*iam.Statement, error) {\n\t// disallow wildcard in the service account name\n\tif strings.Contains(name, \"*\") {\n\t\treturn nil, fmt.Errorf(\"service account name cannot contain a wildcard %s\", name)\n\t}\n\n\t// if the namespace contains a wildcard, use StringLike condition instead of StringEquals\n\tcondition := \"StringEquals\"\n\tif strings.Contains(namespace, \"*\") {\n\t\tcondition = \"StringLike\"\n\t}\n\n\treturn &iam.Statement{\n\t\t\tEffect: \"Allow\",\n\t\t\tPrincipal: iam.Principal{\n\t\t\t\tFederated: \"arn:\" + partition + \":iam::\" + accountId + \":oidc-provider/\" + oidcProvider,\n\t\t\t},\n\t\t\tAction: stringorset.String(\"sts:AssumeRoleWithWebIdentity\"),\n\t\t\tCondition: map[string]interface{}{\n\t\t\t\tcondition: map[string]interface{}{\n\t\t\t\t\toidcProvider + \":sub\": \"system:serviceaccount:\" + namespace + \":\" + name,\n\t\t\t\t},","sourceCodeStart":390,"sourceCodeEnd":426,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/iam.go#L390-L426","documentation":"The service-account name used in an IAM trust-policy statement contains '*', which is disallowed: a wildcard in the name portion would grant the role to every service account in the namespace.","triggerScenarios":"Thrown at pkg/model/awsmodel/iam.go:408 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove wildcards from serviceAccount names in the IAM policy configuration","Specify the exact service account name","Use the namespace-wide grant form via supported config instead of a name wildcard"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}