getsops/sops · error

failed to construct STS session name: %w

Error message

failed to construct STS session name: %w

What it means

Before assuming a role, sops builds a session name `sops@<hostname>` and needs the machine hostname via osHostname(). If the OS hostname lookup fails, this error wraps that failure. It is rare and almost always indicates a broken local hostname resolution on the machine.

Source

Thrown at kms/keysource.go:465

	client := sts.NewFromConfig(*config)
	out, err := client.AssumeRole(ctx, input)
	if err != nil {
		return nil, fmt.Errorf("failed to assume role '%s': %w", key.Role, err)
	}

	config.Credentials = credentials.NewStaticCredentialsProvider(*out.Credentials.AccessKeyId,
		*out.Credentials.SecretAccessKey, *out.Credentials.SessionToken,
	)
	return config, nil
}

// stsSessionName returns the name for the STS session in the format of
// `sops@<hostname>`. It sanitizes the hostname with stsSessionRegex, and
// truncates to roleSessionNameLengthLimit when it exceeds the limit.
func stsSessionName() (string, error) {
	hostname, err := osHostname()
	if err != nil {
		return "", fmt.Errorf("failed to construct STS session name: %w", err)
	}

	re := regexp.MustCompile(stsSessionRegex)
	sanitizedHostname := re.ReplaceAllString(hostname, "")

	name := "sops@" + sanitizedHostname
	if len(name) >= roleSessionNameLengthLimit {
		name = name[:roleSessionNameLengthLimit]
	}
	return name, nil
}

func stringPointerToStringMap(in map[string]*string) map[string]string {
	var out = make(map[string]string)
	for k, v := range in {
		if v == nil {
			continue
		}

View on GitHub (pinned to 13442bb981)

Solutions

1. Fix the machine hostname: run `hostname` to check; if empty, set it (e.g. `sudo hostnamectl set-hostname myhost` or docker run --hostname).
2. Ensure /etc/hostname (Linux) exists and is readable, and the hostname is resolvable.
3. As a workaround in ephemeral sandboxes, set the container hostname explicitly at launch.
4. Retry after fixing; the error is deterministic until hostname lookup succeeds.

Example fix

// before
$ docker run --rm sops-image  # hostname may be a random hash or lookup may fail
// after
$ docker run --rm --hostname sops-runner sops-image

// Go
if _, err := os.Hostname(); err != nil {
  return fmt.Errorf("hostname unavailable; STS session name cannot be built: %w", err)
}

// Go
if err != nil && strings.Contains(err.Error(), "failed to construct STS session name") {
  return fmt.Errorf("fix machine hostname (hostnamectl set-hostname or --hostname) before retrying: %w", err)
}

When it happens

Trigger: EncryptContext/DecryptContext with a KMS key that has a Role set, causing createSTSConfig to call stsSessionName, when os.Hostname() returns an error (e.g. host name not set, /proc/sys/kernel/hostname unreadable, or in odd container sandboxes).

Common situations: Containers or chroots where the hostname is unset or /etc/hostname is missing; restricted environments where syscalls to get the hostname fail.

Related errors

• failed to assume role '%s': %w
• failed to get HuaweiCloud credentials: %w
• %s's entry %d is empty
• no valid ARN found in '%s'
• could not load AWS config: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/2046f42d35b2e92c. Report an issue: GitHub.