kubernetes/kops · error

building AWS STS presigned request: %w

Error message

building AWS STS presigned request: %w

What it means

getSTSHost wraps a failure from the STS presign client building a presigned GetCallerIdentity request, used to discover the regional STS hostname. Presigning happens locally (no network call) but still requires valid credentials and client configuration, so it fails when either is unusable.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:141

	region := a.region

	req, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)
	if err != nil {
		return "", fmt.Errorf("building (v1) signed request: %w", err)
	}
	headers, err := json.Marshal(req.Header)
	if err != nil {
		return "", fmt.Errorf("converting headers to json: %w", err)
	}
	return AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil
}

func (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {
	// An inefficient but reliable way to get the STS url
	presignClient := sts.NewPresignClient(a.sts)
	stsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
	if err != nil {
		return "", fmt.Errorf("building AWS STS presigned request: %w", err)
	}
	u, err := url.Parse(stsRequest.URL)
	if err != nil {
		return "", fmt.Errorf("parsing AWS STS url: %w", err)
	}
	return u.Host, err
}

func (a *awsAuthenticator) createTokenV2(ctx context.Context, body []byte) (string, error) {
	sha := sha256.Sum256(body)

	presignClient := sts.NewPresignClient(a.sts)

	// Ensure the signature is only valid for this particular body content.
	stsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}, func(po *sts.PresignOptions) {
		po.ClientOptions = append(po.ClientOptions, func(o *sts.Options) {
			o.APIOptions = append(o.APIOptions, smithyhttp.AddHeaderValue("X-Kops-Request-SHA", base64.RawStdEncoding.EncodeToString(sha[:])))
		})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate credentials are retrievable before calling CreateToken (e.g. `aws sts get-caller-identity`).
2. Rebuild the sts.Client via sts.NewFromConfig(config.LoadDefaultConfig(ctx, config.WithRegion("<region>"))).
3. If running in EKS/ECS, confirm the pod/task role is assumed and the credentials process has finished before bootstrap.
4. Pin aws-sdk-go-v2 module versions consistently across go.mod and re-run `make gomod`.

Example fix

// before: client without region
stsc := sts.NewFromConfig(cfg)
// after: explicit region so presign resolves a real STS endpoint
cfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion("eu-west-1"))
stsc := sts.NewFromConfig(cfg)

creds, err := credProvider.Retrieve(ctx)
if err != nil {
	return fmt.Errorf("resolve credentials before presigning: %w", err)
}

for attempt := 0; attempt < 3; attempt++ {
	if _, err := auth.CreateToken(body); err == nil { break }
	time.Sleep(time.Duration(1<<attempt) * time.Second) // creds may still be initializing
}

When it happens

Trigger: PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}) errors inside getSTSHost, which is called by createTokenV1 during CreateToken: credentials cannot be resolved for signing, or the sts.Client is misconfigured/nil-adjacent options are invalid.

Common situations: Expired credentials at presign time; STS client created with an invalid region or endpoint; a lambda/container env where the credentials chain has not populated yet at startup; SDK version skew between sts and credentials modules after `go mod` upgrades.

Related errors

• getting AWS STS url: %w
• arn %q has unrecognized type
• arn %q contains too few slashes
• parsing STS request URL: %w
• building presigned request: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b6aed79bb2bcebcc. Report an issue: GitHub.