kubernetes/kops · error

AWS partition was empty

Error message

AWS partition was empty

What it means

This error is thrown by the ARN-parsing helper in awsup when an ARN parsed into its account ID and partition yields an empty partition. The library treats an ARN without a partition as malformed because the partition (aws, aws-cn, aws-us-gov) is required to construct correct service endpoints and identify the account's environment. It is a defensive validation immediately after ARN parsing.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:2123

// AccountInfo returns the AWS account ID and AWS partition that we are deploying into
func (c *awsCloudImplementation) AccountInfo(ctx context.Context) (string, string, error) {
	request := &sts.GetCallerIdentityInput{}

	response, err := c.sts.GetCallerIdentity(ctx, request)
	if err != nil {
		return "", "", fmt.Errorf("error getting AWS account ID: %v", err)
	}

	arn, err := arn.Parse(aws.ToString(response.Arn))
	if err != nil {
		return "", "", fmt.Errorf("failed to parse GetCallerIdentity ARN: %w", err)
	}

	if arn.AccountID == "" {
		return "", "", fmt.Errorf("AWS account id was empty")
	}
	if arn.Partition == "" {
		return "", "", fmt.Errorf("AWS partition was empty")
	}
	return arn.AccountID, arn.Partition, nil
}

// GetRolesInInstanceProfile return role names which are associated with the instance profile specified by profileName.
func GetRolesInInstanceProfile(c AWSCloud, profileName string) ([]string, error) {
	output, err := c.IAM().GetInstanceProfile(context.TODO(), &iam.GetInstanceProfileInput{
		InstanceProfileName: aws.String(profileName),
	})
	if err != nil {
		return nil, err
	}
	var roleNames []string
	for _, role := range output.InstanceProfile.Roles {
		roleNames = append(roleNames, *role.RoleName)
	}
	return roleNames, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the ARN string in your cluster spec / flag / env var is a complete valid ARN of the form arn:partition:service:region:account-id:resource
2. Fix typos where the partition segment is missing or empty (e.g. arn:aws:iam::123456789012:role/name)
3. Confirm the resource actually exists with the AWS CLI (aws iam get-role / aws sts get-caller-identity) so you copy a real ARN

Example fix

// before
KOPS_STATE_STORE_ARN="arn:aws:iam::123456789012:role/"  // truncated ARN
// after
KOPS_STATE_STORE_ARN="arn:aws:iam::123456789012:role/kops-state-store"

// validate ARN shape before use
var arnRe = regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):[a-z0-9-]*:[a-z0-9-]*:[0-9]{0,12}:.+$`)
func validARN(arn string) bool { return arnRe.MatchString(arn) }

func isARNPartitionPresent(parsedArn arn.ARN) bool {
    return parsedArn.Partition != "" && parsedArn.AccountID != ""
}

acct, part, err := ParseARN(arnStr)
if err != nil {
    return fmt.Errorf("invalid ARN %q: %w", arnStr, err)
}

When it happens

Trigger: Calling the helper that splits an ARN into (accountID, partition) with an ARN string that either is not a valid ARN or whose arn:partition:segment is missing/empty, so the parsed ARN.Partition field is the empty string.

Common situations: Passing a malformed IAM role or instance-profile ARN in cluster config (typos like 'arn:aws::123456789012:role/foo' with missing fields), environment variables or kops flags holding placeholder values like empty strings, or copy-pasted ARNs from other clouds/docs that were never valid.

Related errors

• VPC ID is required when InternetGateway is shared
• Region is not a recognized EC2 region: %q (check you have sp
• --region is required (when --external)
• failed to load default aws config for IMDS client: %w
• failed to load default aws config for STS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/19039849e9aa938d. Report an issue: GitHub.