kubernetes/kops · error

arn %q has unrecognized service

Error message

arn %q has unrecognized service

What it means

Same ARN validation in verifyCallerIdentity: after confirming the 'arn' prefix and part count, the service segment must be 'sts'. Any other service in the caller's ARN is rejected, since node bootstrap authentication must be proven via an STS GetCallerIdentity response.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:271

func (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {
	if callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {
		return nil, fmt.Errorf("incorrect account %s", callerIdentity.GetCallerIdentityResult[0].Account)
	}

	arn := callerIdentity.GetCallerIdentityResult[0].Arn
	parts := strings.Split(arn, ":")
	if len(parts) != 6 {
		return nil, fmt.Errorf("arn %q contains unexpected number of colons", arn)
	}
	if parts[0] != "arn" {
		return nil, fmt.Errorf("arn %q doesn't start with \"arn:\"", arn)
	}
	if parts[1] != a.partition {
		return nil, fmt.Errorf("arn %q not in partion %q", arn, a.partition)
	}
	if parts[2] != "iam" && parts[2] != "sts" {
		return nil, fmt.Errorf("arn %q has unrecognized service", arn)
	}
	// parts[3] is region
	// parts[4] is account
	resource := strings.Split(parts[5], "/")
	if resource[0] != "assumed-role" {
		return nil, fmt.Errorf("arn %q has unrecognized type", arn)
	}
	if len(resource) < 3 {
		return nil, fmt.Errorf("arn %q contains too few slashes", arn)
	}
	found := false
	for _, role := range a.opt.NodesRoles {
		if resource[1] == role {
			found = true
			break
		}
	}
	if !found {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the token derives from an STS call
2. Check IAM identity configuration
3. Report unexpected ARN services to maintainers

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:271 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/087606e24040614e. Report an issue: GitHub.