kubernetes/kops · error

arn %q doesn't start with "arn:"

Error message

arn %q doesn't start with "arn:"

What it means

verifyCallerIdentity splits the STS-reported ARN on ':' and requires 6 colon-separated parts; this guard fires when the ARN does not begin with the literal 'arn'. It validates that GetCallerIdentity returned a well-formed ARN for the requesting node before extracting account/partition.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:265

	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

type verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)

func (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {
	if callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {
		return nil, fmt.Errorf("incorrect account %s", callerIdentity.GetCallerIdentityResult[0].Account)
	}

	arn := callerIdentity.GetCallerIdentityResult[0].Arn
	parts := strings.Split(arn, ":")
	if len(parts) != 6 {
		return nil, fmt.Errorf("arn %q contains unexpected number of colons", arn)
	}
	if parts[0] != "arn" {
		return nil, fmt.Errorf("arn %q doesn't start with \"arn:\"", arn)
	}
	if parts[1] != a.partition {
		return nil, fmt.Errorf("arn %q not in partion %q", arn, a.partition)
	}
	if parts[2] != "iam" && parts[2] != "sts" {
		return nil, fmt.Errorf("arn %q has unrecognized service", arn)
	}
	// parts[3] is region
	// parts[4] is account
	resource := strings.Split(parts[5], "/")
	if resource[0] != "assumed-role" {
		return nil, fmt.Errorf("arn %q has unrecognized type", arn)
	}
	if len(resource) < 3 {
		return nil, fmt.Errorf("arn %q contains too few slashes", arn)
	}
	found := false
	for _, role := range a.opt.NodesRoles {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify STS returned a standard ARN
2. Check identity configuration
3. Report malformed ARNs to maintainers

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:265 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7e98b8c4801bfc36. Report an issue: GitHub.