kubernetes/kops · error

failed to resolve endpoint: %v

Error message

failed to resolve endpoint: %v

What it means

Resolving the regional service endpoint used in kms:ViaService conditions failed while building the IAM policy; the AWS endpoint resolver could not map the service/region/partition combination for the cluster.

Source

Thrown at pkg/model/iam/iam_builder.go:1522

// S3 (for SSE-KMS on the state-store bucket).
//
// Per AWS KMS docs the value is "<service>.<region>.amazonaws.com" — the
// ".amazonaws.com" suffix is used in all partitions (including aws-cn,
// aws-us-gov, aws-iso, aws-iso-b); the partition-specific suffixes used for
// service endpoints do NOT apply to kms:ViaService.
// See: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html
//
// EC2 is pinned to the cluster's region (EBS is always in-region). S3 uses a
// region wildcard because kops supports cross-region state-store buckets; the
// caller must therefore evaluate the values under StringLike, not StringEquals.
// IAMServiceEC2 returns the name of the IAM service for EC2 in the current region.
// It is ec2.amazonaws.com in the default aws partition, but different in other isolated/custom partitions
func IAMServiceEC2(region string) (string, error) {
	ctx := context.TODO()
	resolver := ec2.NewDefaultEndpointResolverV2()
	ep, err := resolver.ResolveEndpoint(ctx, ec2.EndpointParameters{Region: aws.String(region)})
	if err != nil {
		return "", fmt.Errorf("failed to resolve endpoint: %v", err)
	}
	if ep.URI.Host != "" {
		// Remove the region from the hostname. Examples:
		// ec2.us-east-1.amazonaws.com     -> ec2.amazonaws.com
		// ec2.cn-west-1.amazonaws.com.cn  -> ec2.amazonaws.com.cn
		// ec2.us-gov-west-1.amazonaws.com -> ec2.amazonaws.com
		return strings.ReplaceAll(ep.URI.Host, fmt.Sprintf("%v.", region), ""), nil
	}
	return "ec2.amazonaws.com", nil
}

func kmsViaServices(region string) []string {
	if region == "" {
		return nil
	}
	return []string{
		fmt.Sprintf("ec2.%s.amazonaws.com", region),
		"s3.*.amazonaws.com",

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the cluster's region is valid for the configured partition
2. Upgrade kops — the endpoint resolution data may be stale
3. Check for custom endpoint overrides in the environment

When it happens

Trigger: Thrown at pkg/model/iam/iam_builder.go:1522 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cfe0207aa5f758c2. Report an issue: GitHub.