kubernetes/kops · error

parsing AWS STS url: %w

Error message

parsing AWS STS url: %w

What it means

getSTSHost wraps a failure from url.Parse(stsRequest.URL) after a successful presign. The presigned URL string could not be parsed as a URL, so the STS hostname cannot be extracted. This is nearly impossible with SDK-generated URLs and indicates a corrupted or overridden endpoint value.

Source

Thrown at pkg/bootstrap/awsbootstrap/authenticator.go:145

		return "", fmt.Errorf("building (v1) signed request: %w", err)
	}
	headers, err := json.Marshal(req.Header)
	if err != nil {
		return "", fmt.Errorf("converting headers to json: %w", err)
	}
	return AWSAuthenticationTokenPrefixV1 + base64.StdEncoding.EncodeToString(headers), nil
}

func (a *awsAuthenticator) getSTSHost(ctx context.Context) (string, error) {
	// An inefficient but reliable way to get the STS url
	presignClient := sts.NewPresignClient(a.sts)
	stsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
	if err != nil {
		return "", fmt.Errorf("building AWS STS presigned request: %w", err)
	}
	u, err := url.Parse(stsRequest.URL)
	if err != nil {
		return "", fmt.Errorf("parsing AWS STS url: %w", err)
	}
	return u.Host, err
}

func (a *awsAuthenticator) createTokenV2(ctx context.Context, body []byte) (string, error) {
	sha := sha256.Sum256(body)

	presignClient := sts.NewPresignClient(a.sts)

	// Ensure the signature is only valid for this particular body content.
	stsRequest, err := presignClient.PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}, func(po *sts.PresignOptions) {
		po.ClientOptions = append(po.ClientOptions, func(o *sts.Options) {
			o.APIOptions = append(o.APIOptions, smithyhttp.AddHeaderValue("X-Kops-Request-SHA", base64.RawStdEncoding.EncodeToString(sha[:])))
		})
	})
	if err != nil {
		return "", fmt.Errorf("building AWS STS presigned request: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check AWS_ENDPOINT_URL / AWS_ENDPOINT_URL_STS and any BaseEndpoint override — fix typos and ensure a valid https:// URL.
2. Remove the custom endpoint and retest against the default regional STS endpoint.
3. If using a local mock (localstack etc.), ensure the endpoint URL is well-formed, e.g. https://sts.local:4566.

Example fix

// before
AWS_ENDPOINT_URL="sts amazonaws com"  // invalid
// after
AWS_ENDPOINT_URL="https://sts.us-east-1.amazonaws.com"

if ep := os.Getenv("AWS_ENDPOINT_URL_STS"); ep != "" {
	if _, err := url.Parse(ep); err != nil || !strings.HasPrefix(ep, "https://") {
		return fmt.Errorf("invalid AWS_ENDPOINT_URL_STS: %q", ep)
	}
}

host, err := a.getSTSHost(ctx)
if err != nil {
	return fmt.Errorf("check AWS_ENDPOINT_URL / BaseEndpoint config: %w", err)
}

When it happens

Trigger: url.Parse fails inside getSTSHost (called by createTokenV1 via CreateToken) — only if stsRequest.URL contains invalid characters, typically from a misconfigured custom STS BaseEndpoint containing spaces/invalid characters.

Common situations: Custom STS endpoint set via AWS_ENDPOINT_URL or sts client BaseEndpoint with a typo (e.g. missing scheme or embedded whitespace); proxy env vars injecting garbage into endpoint resolution in unusual test setups.

Related errors

• parsing STS request URL: %w
• parsing presigned url: %w
• failed to load default aws config for STS client: %w
• getting AWS STS url: %w
• building AWS STS presigned request: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0a907a5e66d18661. Report an issue: GitHub.