gravitational/teleport · error

region has no known FIPS endpoint

Error message

region has no known FIPS endpoint

What it means

ErrNoFIPSEndpoint is returned by ExpectedSTSHost and validateSTSHost when a FIPS-mode AWS STS endpoint is requested for an AWS region that has no FIPS STS endpoint (checked against FIPSSTSRegions). The AWS SDK would otherwise happily produce a non-existent FIPS hostname, so Teleport fails early.

Source

Thrown at lib/auth/join/iam/iam.go:135

			stsOpts.RetryMaxAttempts = 1

			stsOpts.TracerProvider = smithyoteltracing.Adapt(otel.GetTracerProvider())
		})

	if _, err = stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}); !errors.Is(err, errRequestRecorded) {
		if err == nil {
			return nil, trace.Errorf("expected to get errRequestRecorded, got <nil> (this is a bug)")
		}
		return nil, trace.Wrap(err, "building signed sts:GetCallerIdentity request")
	}

	return signedRequest.Bytes(), nil
}

var (
	// ErrNoFIPSEndpoint is returned when a FIPS endpoint is requested for a
	// region that has none.
	ErrNoFIPSEndpoint = errors.New("region has no known FIPS endpoint")
)

// ExpectedSTSHost returns the expected AWS STS endpoint hostname in the given region and FIPS mode.
func ExpectedSTSHost(ctx context.Context, region string, fips bool) (string, error) {
	// This check is necessary because the AWS SDK will happily return FIPS
	// endpoints that don't exist in regions that don't have one.
	if fips && !slices.Contains(FIPSSTSRegions(), region) {
		return "", ErrNoFIPSEndpoint
	}
	resolver := sts.NewDefaultEndpointResolverV2()
	endpoint, err := resolver.ResolveEndpoint(ctx, sts.EndpointParameters{
		Region:  aws.String(region),
		UseFIPS: aws.Bool(fips),
	})
	if err != nil {
		return "", trace.Wrap(err)
	}
	return endpoint.URI.Hostname(), nil

View on GitHub (pinned to 1283425b60)

Solutions

1. Move the joining node to an AWS region that has a FIPS STS endpoint (see FIPSSTSRegions for the supported set).
2. Disable FIPS mode for the join (so the standard STS endpoint is used) if FIPS STS is not required in that region.
3. In the join caller, handle errors.Is(err, iam.ErrNoFIPSEndpoint) with a clear AccessDenied message instructing the operator about region/FIPS compatibility.

Example fix

// before
expectedSTSHost, err := iam.ExpectedSTSHost(ctx, region, true) // fips in unsupported region
// after
if fips && !slices.Contains(iam.FIPSSTSRegions(), region) {
    return trace.BadParameter("region %q has no FIPS STS endpoint; disable FIPS or use a supported region", region)
}
expectedSTSHost, err := iam.ExpectedSTSHost(ctx, region, fips)

if fips && !slices.Contains(iam.FIPSSTSRegions(), region) {
    return trace.BadParameter("region %q has no FIPS STS endpoint", region)
}

if errors.Is(err, iam.ErrNoFIPSEndpoint) { /* unsupported region for FIPS STS */ }

expectedSTSHost, err := iam.ExpectedSTSHost(ctx, region, fips)
if errors.Is(err, iam.ErrNoFIPSEndpoint) {
    return trace.AccessDenied("node selected FIPS AWS STS endpoint in region with no known FIPS endpoint")
}

When it happens

Trigger: Calling iam.ExpectedSTSHost(ctx, region, true) (or validateSTSHost with fips=true) for a region not in FIPSSTSRegions(); during IAM join, a node selects the FIPS STS endpoint while configured in such a region — the caller at lib/join/iamjoin/iam.go:115 converts it to AccessDenied.

Common situations: Teleport nodes provisioned in newer/opt-in AWS regions lacking FIPS endpoints attempting to join via the IAM method with FIPS mode enabled; misconfigured FIPS build assumptions in non-US regions.

Related errors

• no Access Graph fetchers

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/bcb7bc5bd4e0d114. Report an issue: GitHub.