kubernetes/kops · error

resolving EC2 endpoint for region %q: %w

Error message

resolving EC2 endpoint for region %q: %w

What it means

SupportsS3BootstrapEndpoint resolves the EC2 endpoint for a region with the SDK v2 endpoint resolver to learn the partition DNS suffix; if resolution fails (typically because the region is unknown to the resolver), the error is wrapped with this message. The function compares the resolved hostname against ec2.<region>.amazonaws.com to decide whether the S3 bootstrap endpoint style applies. Endpoint resolution failure usually means an unrecognized or unsupported region string.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:130

		region = zoneRegion
	}

	if region == "" {
		return "", fmt.Errorf("could not determine cluster region: no subnet specifies a zone")
	}

	return region, nil
}

// SupportsS3BootstrapEndpoint reports whether the region uses the amazonaws.com partition DNS
// suffix hard-coded by the nodeup bootstrap script. EC2 uses the same partition suffix as S3 and
// can be resolved without a bucket.
func SupportsS3BootstrapEndpoint(ctx context.Context, region string) (bool, error) {
	resolver := ec2.NewDefaultEndpointResolverV2()
	endpoint, err := resolver.ResolveEndpoint(ctx, ec2.EndpointParameters{Region: aws.String(region)})
	if err != nil {
		return false, fmt.Errorf("resolving EC2 endpoint for region %q: %w", region, err)
	}

	return endpoint.URI.Hostname() == fmt.Sprintf("ec2.%s.amazonaws.com", region), nil
}

// FindEC2Tag find the value of the tag with the specified key
func FindEC2Tag(tags []ec2types.Tag, key string) (string, bool) {
	for _, tag := range tags {
		if key == aws.ToString(tag.Key) {
			return aws.ToString(tag.Value), true
		}
	}
	return "", false
}

// FindASGTag find the value of the tag with the specified key
func FindASGTag(tags []autoscalingtypes.TagDescription, key string) (string, bool) {
	for _, tag := range tags {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use a correct, current AWS region name for the target partition
2. Upgrade kops / aws-sdk-go-v2 so the endpoint resolver knows about newer regions
3. Set SKIP_REGION_CHECK or override endpoints if operating in a custom partition (advanced)

Example fix

// before
kops create cluster --region us-east-42 ...
// after
kops create cluster --region us-east-1 ...

// ensure region is non-empty and matches known AWS naming before the call
if region == "" || !regexp.MustCompile(`^[a-z]{2}(-gov)?-[a-z]+-\d$`).MatchString(region) {
    return fmt.Errorf("bad region %q", region)
}

ok, err := SupportsS3BootstrapEndpoint(ctx, region)
if err != nil {
    return fmt.Errorf("cannot resolve endpoints for %q; upgrade SDK or fix region: %w", region, err)
}

When it happens

Trigger: Calling SupportsS3BootstrapEndpoint (directly or via ResolveS3Region / awsValidateS3FileRepositoryPartition) with a region the ec2 endpoint resolver cannot map — typos, empty region, or regions from other partitions not in the resolver's endpoints model.

Common situations: New AWS regions not yet in the bundled AWS SDK endpoint model (SDK too old); misspelled region passed to kops; custom/private deployments whose region is not in the public endpoint set.

Related errors

• failed to resolve endpoint for %q: %w
• getting AWS STS url: %w
• failed to generate AWS IAM S3 access statements: %v
• cannot parse VFS path %q: %v
• path is not cluster readable: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0018bdc85fb6f4a9. Report an issue: GitHub.