kubernetes/kops · error

getting AWS STS url

Error message

getting AWS STS url: %w

What it means

createTokenV1 wraps a failure from getSTSHost, which resolves the regional STS endpoint hostname by building a presigned GetCallerIdentity request. If the presign call fails, the authenticator cannot determine the STS URL to sign against, so the v1 token creation aborts.

Solutions

1. Confirm the STS client passed to the authenticator was built with a valid AWS region (AWS_REGION or config option WithRegion).
2. Run `aws sts get-caller-identity --region <region>` to confirm the regional STS endpoint resolves from this machine.
3. Check for a custom BaseEndpoint/endpoint override on the sts.Client that may be wrong or unreachable.
4. Regenerate the sts.Client from a fresh config.LoadDefaultConfig call with proper credential/region options.

Example fix

// before
cfg, _ := config.LoadDefaultConfig(ctx)
stsc := sts.NewFromConfig(cfg) // region may be empty
// after
cfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion("us-east-1"))
stsc := sts.NewFromConfig(cfg)

if cfg.Region == "" {
	return fmt.Errorf("AWS region must be set (AWS_REGION or config.WithRegion)")
}

host, err := a.getSTSHost(ctx)
if err != nil {
	return fmt.Errorf("cannot resolve STS endpoint, check region config: %w", err)
}

When it happens

Trigger: a.getSTSHost(ctx) errors inside CreateToken (v1 path): sts.NewPresignClient(a.sts).PresignGetCallerIdentity fails due to nil/misconfigured STS client, invalid region, or SDK client construction failure.

Common situations: STS client built with an unknown/unsupported region name; AWS SDK config LoadDefaultConfig failed silently producing a client with no region; endpoint override pointing to an unreachable custom STS endpoint; SDK version mismatch in sts options.

Related errors

• arn contains too few slashes
• arn has unrecognized type
• building AWS STS presigned request
• parsing presigned url
• parsing STS request URL

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/789520b98f58d3a0. Report an issue: GitHub.

Appendix: source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:120

	// and nodes at much higher versions is not guaranteed to be supported by kube,
	// so once we are at kOps 1.32 this shoud be safe to flip to use V2.
	// It's possibly safe at kOps 1.31 but that might need more careful analysis.
	signWithV1 := true
	if signWithV1 {
		return a.createTokenV1(ctx, body)
	}
	return a.createTokenV2(ctx, body)
}

func (a *awsAuthenticator) createTokenV1(ctx context.Context, body []byte) (string, error) {
	credentials, err := a.credentialsProvider.Retrieve(ctx)
	if err != nil {
		return "", fmt.Errorf("getting AWS credentials: %w", err)
	}

	host, err := a.getSTSHost(ctx)
	if err != nil {
		return "", fmt.Errorf("getting AWS STS url: %w", err)
	}
	stsURL := "https://" + host + "/"
	region := a.region

	req, err := signV1Request(ctx, stsURL, region, credentials, time.Now(), body)
	if err != nil {
		return "", fmt.Errorf("building (v1) signed request: %w", err)
	}
	headers, err := json.Marshal(req.Header)
	if err != nil {
		return "", fmt.Errorf("converting headers to json: %w", err)
	}
	return AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil
}

func (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {
	// An inefficient but reliable way to get the STS url
	presignClient := sts.NewPresignClient(a.sts)

View on GitHub (pinned to 4c8573c808)