kubernetes/kops · critical

error getting AWS account ID

Error message

error getting AWS account ID: %v

What it means

kOps' AccountInfo calls STS GetCallerIdentity to determine the AWS account ID and partition being deployed into (aws_cloud.go:2111). This error wraps any failure of that STS call. Since GetCallerIdentity is the canonical credential probe, this almost always signals an authentication, permission, or connectivity problem with AWS.

Solutions

1. Run 'aws sts get-caller-identity' with the same credentials/profile to reproduce; fix credentials (env vars, ~/.aws/credentials, or instance profile).
2. If role assumption is involved, verify the role ARN and trust policy; re-run 'aws sts assume-role' manually.
3. Check network access to the STS endpoint (proxy settings, HTTPS_PROXY, VPC endpoints).
4. Sync the system clock (chrony/ntp) if the error mentions RequestTimeTooSkewed.
5. Ensure AWS_REGION / AWS_DEFAULT_REGION is set to a valid region.

Example fix

// before
export AWS_ACCESS_KEY_ID=old-expired-key
// after
aws sso login && export AWS_PROFILE=dev-admin

// preflight credential check before running kOps
func checkAWSCredentials(ctx context.Context, cfg aws.Config) error {
	_, err := cfg.Credentials.Retrieve(ctx)
	return err // fails fast with clear message if no valid credentials
}

func isCredentialError(err error) bool {
	var ce *aws.CredentialsCacheError
	if errors.As(err, &ce) { return true }
	return err != nil && (strings.Contains(err.Error(), "no EC2 IMDS role found") ||
		strings.Contains(err.Error(), "failed to retrieve credentials") ||
		strings.Contains(err.Error(), "InvalidClientTokenId"))
}

accountID, partition, err := cloud.AccountInfo(ctx)
if err != nil {
	if isCredentialError(err) {
		return fmt.Errorf("AWS credentials invalid or missing: run 'aws sts get-caller-identity' to diagnose: %w", err)
	}
	return err
}

When it happens

Trigger: c.sts.GetCallerIdentity returns an error: no credentials found, invalid/expired credentials, STS endpoint unreachable, IAM policy denies sts:GetCallerIdentity (rare), or clock skew causing signature rejection.

Common situations: AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY not set or wrong; assuming a role fails (missing trust or source identity); corporate proxy blocking sts.<region>.amazonaws.com; system clock skew on the machine breaking SigV4 signatures; wrong region endpoint configured.

Related errors

• building presigned request
• getting AWS credentials
• arn contains too few slashes
• arn has unrecognized type
• AWS account id was empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/108a9d170136ca02. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:2111

		InstanceTypes: []ec2types.InstanceType{ec2types.InstanceType(instanceType)},
	}
	resp, err := c.EC2().DescribeInstanceTypes(ctx, req)
	if err != nil {
		return nil, fmt.Errorf("describing instance type %q in region %q: %w", instanceType, c.Region(), err)
	}
	if len(resp.InstanceTypes) != 1 {
		return nil, fmt.Errorf("instance type %q not found in region %q", instanceType, c.Region())
	}
	return &resp.InstanceTypes[0], nil
}

// AccountInfo returns the AWS account ID and AWS partition that we are deploying into
func (c *awsCloudImplementation) AccountInfo(ctx context.Context) (string, string, error) {
	request := &sts.GetCallerIdentityInput{}

	response, err := c.sts.GetCallerIdentity(ctx, request)
	if err != nil {
		return "", "", fmt.Errorf("error getting AWS account ID: %v", err)
	}

	arn, err := arn.Parse(aws.ToString(response.Arn))
	if err != nil {
		return "", "", fmt.Errorf("failed to parse GetCallerIdentity ARN: %w", err)
	}

	if arn.AccountID == "" {
		return "", "", fmt.Errorf("AWS account id was empty")
	}
	if arn.Partition == "" {
		return "", "", fmt.Errorf("AWS partition was empty")
	}
	return arn.AccountID, arn.Partition, nil
}

// GetRolesInInstanceProfile return role names which are associated with the instance profile specified by profileName.
func GetRolesInInstanceProfile(c AWSCloud, profileName string) ([]string, error) {

View on GitHub (pinned to 4c8573c808)