kubernetes/kops · error

received status code %d from STS: %s

Error message

received status code %d from STS: %s

What it means

Status guard in getCallerIdentityV2: STS returned a non-200 HTTP status for the replayed presigned request (e.g. 403 signature mismatch or throttling), with the body included for diagnosis. The identity verification failed server-side.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:424

	req := &http.Request{
		URL:    reqURL,
		Method: decoded.Method,
		Header: decoded.SignedHeader,
	}
	response, err := httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("sending STS request: %v", err)
	}
	if response != nil {
		defer response.Body.Close()
	}

	responseBody, err := io.ReadAll(response.Body)
	if err != nil {
		return nil, fmt.Errorf("reading STS response: %v", err)
	}
	if response.StatusCode != 200 {
		return nil, fmt.Errorf("received status code %d from STS: %s", response.StatusCode, string(responseBody))
	}

	callerIdentity := &GetCallerIdentityResponse{}
	err = xml.NewDecoder(bytes.NewReader(responseBody)).Decode(callerIdentity)
	if err != nil {
		return nil, fmt.Errorf("decoding STS response: %v", err)
	}

	return callerIdentity, nil
}

// GetCallerIdentityV1 will request the presigned token URL, and decode the returned identity.
func (s *stsRequestValidator) getCallerIdentityV1(ctx context.Context, httpClient *http.Client, decoded awsV1Token) (*GetCallerIdentityResponse, error) {
	// Well-known V1 request body
	body := []byte("Action=GetCallerIdentity&Version=2011-06-15")

	// The host is not passed in V1 (a shortcoming of V1)
	host := s.Host

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check for expired presigned URLs
2. Verify clock skew between node and AWS
3. Retry after throttling backs off

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:424 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c812d6c50ba0f730. Report an issue: GitHub.