{"record":{"id":"fdb1ff8c5f298ce1","repo":"kubernetes/kops","slug":"invalid-sts-url-host-q-path-q","errorCode":null,"errorMessage":"invalid STS url: host=%q, path=%q","messagePattern":"invalid STS url: host=%q, path=%q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":241,"sourceCode":"\t}\n\n\t// Verify the token has signed the body content.\n\tsha := sha256.Sum256(body)\n\tif decoded.SignedHeader.Get(\"X-Kops-Request-SHA\") != base64.RawStdEncoding.EncodeToString(sha[:]) {\n\t\treturn nil, fmt.Errorf(\"incorrect SHA\")\n\t}\n\n\treqURL, err := url.Parse(decoded.URL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing STS request URL: %v\", err)\n\t}\n\tsignedHeaders := sets.New(strings.Split(reqURL.Query().Get(\"X-Amz-SignedHeaders\"), \";\")...)\n\tif !signedHeaders.Has(\"x-kops-request-sha\") {\n\t\treturn nil, fmt.Errorf(\"unexpected signed headers value\")\n\t}\n\n\tif !a.stsRequestValidator.isValidV2(reqURL) {\n\t\treturn nil, fmt.Errorf(\"invalid STS url: host=%q, path=%q\", reqURL.Host, reqURL.Path)\n\t}\n\n\tcallerIdentity, err := a.stsRequestValidator.getCallerIdentityV2(ctx, &a.client, &decoded)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn verifyCallerIdentity(ctx, callerIdentity)\n}\n\ntype verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)\n\nfunc (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {\n\tif callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {\n\t\treturn nil, fmt.Errorf(\"incorrect account %s\", callerIdentity.GetCallerIdentityResult[0].Account)\n\t}\n\n\tarn := callerIdentity.GetCallerIdentityResult[0].Arn","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L223-L259","documentation":"Verification guard in verifyTokenV2: the presigned STS URL did not pass isValidV2 (wrong host/path — must be the STS endpoint and GetCallerIdentity action), so the URL is not a legitimate STS identity request.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:241 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the regional STS endpoint hostname","Presign a GetCallerIdentity request","Update kOps if the endpoint format changed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}