kubernetes/kops · error

failed to parse GetCallerIdentity ARN: %w

Error message

failed to parse GetCallerIdentity ARN: %w

What it means

After a successful STS GetCallerIdentity, kOps parses response.Arn with github.com/aws/aws-sdk-go-v2/aws/arn (aws_cloud.go:2116). This error indicates the returned ARN string is empty or not a syntactically valid ARN. It signals an unexpected/nonstandard response from STS rather than a user configuration error.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:2116

	}
	if len(resp.InstanceTypes) != 1 {
		return nil, fmt.Errorf("instance type %q not found in region %q", instanceType, c.Region())
	}
	return &resp.InstanceTypes[0], nil
}

// AccountInfo returns the AWS account ID and AWS partition that we are deploying into
func (c *awsCloudImplementation) AccountInfo(ctx context.Context) (string, string, error) {
	request := &sts.GetCallerIdentityInput{}

	response, err := c.sts.GetCallerIdentity(ctx, request)
	if err != nil {
		return "", "", fmt.Errorf("error getting AWS account ID: %v", err)
	}

	arn, err := arn.Parse(aws.ToString(response.Arn))
	if err != nil {
		return "", "", fmt.Errorf("failed to parse GetCallerIdentity ARN: %w", err)
	}

	if arn.AccountID == "" {
		return "", "", fmt.Errorf("AWS account id was empty")
	}
	if arn.Partition == "" {
		return "", "", fmt.Errorf("AWS partition was empty")
	}
	return arn.AccountID, arn.Partition, nil
}

// GetRolesInInstanceProfile return role names which are associated with the instance profile specified by profileName.
func GetRolesInInstanceProfile(c AWSCloud, profileName string) ([]string, error) {
	output, err := c.IAM().GetInstanceProfile(context.TODO(), &iam.GetInstanceProfileInput{
		InstanceProfileName: aws.String(profileName),
	})
	if err != nil {
		return nil, err

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect what sts get-caller-identity returns with the same endpoint/credentials; confirm the Arn field is a proper ARN.
2. Remove any custom STS endpoint overrides (AWS_ENDPOINT_URL, awsup endpoint config) unless intentionally using LocalStack/MinIO.
3. If using LocalStack, upgrade it so GetCallerIdentity returns a well-formed ARN like arn:aws:iam::123456789012:user/test.
4. Upgrade the AWS SDK / kOps if the response is genuinely valid but parsing fails (SDK version bug).

Example fix

// before (env)
AWS_ENDPOINT_URL=http://old-sts-proxy:9999
// after
unset AWS_ENDPOINT_URL  # use real STS

// sanity-check the STS response shape before relying on it
func validCallerIdentityARN(arnStr string) bool {
	if arnStr == "" { return false }
	parsed, err := arn.Parse(arnStr)
	return err == nil && parsed.Service == "sts" && parsed.AccountID != ""
}

func isARNParseFailure(err error) bool {
	return err != nil && strings.Contains(err.Error(), "failed to parse GetCallerIdentity ARN")
}

accountID, partition, err := cloud.AccountInfo(ctx)
if err != nil {
	if isARNParseFailure(err) {
		return fmt.Errorf("STS returned a non-ARN caller identity; check for endpoint overrides (AWS_ENDPOINT_URL) or LocalStack misconfig: %w", err)
	}
	return err
}

When it happens

Trigger: arn.Parse(aws.ToString(response.Arn)) fails because the Arn field is nil/empty, or the string does not match arn:partition:service:region:account-id:resource format — e.g. a mocked/faked STS endpoint, a nonstandard third-party S3-compatible/STS implementation (like MinIO or LocalStack misconfiguration), or a truncated response.

Common situations: Pointing kOps at a custom endpoint override (awsEndpointURL) for a service that returns non-ARN caller identity; LocalStack or similar fake AWS environment returning a malformed ARN; an SDK/response deserialization issue yielding a nil Arn.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• arn %q has unrecognized type
• arn %q contains too few slashes
• AWS account id was empty
• failed to load default aws config for STS client: %w
• getting AWS STS url: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/459caf02746c38a4. Report an issue: GitHub.