kubernetes/kops · error

incorrect account %s

Error message

incorrect account %s

What it means

Verification guard in verifyCallerIdentity: the AWS account returned by STS GetCallerIdentity does not match the account the verifier is configured to trust, so the node belongs to a different AWS account and is rejected.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:256

	}

	if !a.stsRequestValidator.isValidV2(reqURL) {
		return nil, fmt.Errorf("invalid STS url: host=%q, path=%q", reqURL.Host, reqURL.Path)
	}

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV2(ctx, &a.client, &decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

type verifyCallerIdentityFunc func(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error)

func (a awsVerifier) verifyCallerIdentity(ctx context.Context, callerIdentity *GetCallerIdentityResponse) (*bootstrap.VerifyResult, error) {
	if callerIdentity.GetCallerIdentityResult[0].Account != a.accountId {
		return nil, fmt.Errorf("incorrect account %s", callerIdentity.GetCallerIdentityResult[0].Account)
	}

	arn := callerIdentity.GetCallerIdentityResult[0].Arn
	parts := strings.Split(arn, ":")
	if len(parts) != 6 {
		return nil, fmt.Errorf("arn %q contains unexpected number of colons", arn)
	}
	if parts[0] != "arn" {
		return nil, fmt.Errorf("arn %q doesn't start with \"arn:\"", arn)
	}
	if parts[1] != a.partition {
		return nil, fmt.Errorf("arn %q not in partion %q", arn, a.partition)
	}
	if parts[2] != "iam" && parts[2] != "sts" {
		return nil, fmt.Errorf("arn %q has unrecognized service", arn)
	}
	// parts[3] is region
	// parts[4] is account

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run the node in the expected AWS account
2. Configure the verifier with the correct account ID
3. Check for cross-account confusion in the setup

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:256 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9fea72db6eef9e14. Report an issue: GitHub.