kubernetes/kops · error

arn %q contains unexpected number of colons

Error message

arn %q contains unexpected number of colons

What it means

Verification guard in verifyCallerIdentity: the caller ARN does not split into the expected 6 colon-separated ARN parts, so it cannot be parsed into partition/service/resource components for validation.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:262

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV2(ctx, &a.client, &decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

type verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)

func (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {
	if callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {
		return nil, fmt.Errorf("incorrect account %s", callerIdentity.GetCallerIdentityResult[0].Account)
	}

	arn := callerIdentity.GetCallerIdentityResult[0].Arn
	parts := strings.Split(arn, ":")
	if len(parts) != 6 {
		return nil, fmt.Errorf("arn %q contains unexpected number of colons", arn)
	}
	if parts[0] != "arn" {
		return nil, fmt.Errorf("arn %q doesn't start with \"arn:\"", arn)
	}
	if parts[1] != a.partition {
		return nil, fmt.Errorf("arn %q not in partion %q", arn, a.partition)
	}
	if parts[2] != "iam" && parts[2] != "sts" {
		return nil, fmt.Errorf("arn %q has unrecognized service", arn)
	}
	// parts[3] is region
	// parts[4] is account
	resource := strings.Split(parts[5], "/")
	if resource[0] != "assumed-role" {
		return nil, fmt.Errorf("arn %q has unrecognized type", arn)
	}
	if len(resource) < 3 {
		return nil, fmt.Errorf("arn %q contains too few slashes", arn)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check for unusual ARN formats from STS
2. Verify the IAM role/identity configuration
3. Report odd ARNs to kOps maintainers

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:262 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/99fa3d1f24383b98. Report an issue: GitHub.