Error: checking AWS STS access – cannot get role ARN for current session: MissingEndpoint: 'Endpoint' configuration is required for this service

Question

I created a cluster.yaml file which contains the below information:

---
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: eks-litmus-demo
  region: ${AWS_REGION}
  version: "1.21"
managedNodeGroups:
  - instanceType: m5.large
    amiFamily: AmazonLinux2
    name: eks-litmus-demo-ng
    desiredCapacity: 2
    minSize: 2
    maxSize: 4
EOF

When i run $ eksctl create cluster -f cluster.yaml to create the cluster through my terminal, I get the below error:

Error: checking AWS STS access – cannot get role ARN for current session: MissingEndpoint: 'Endpoint' configuration is required for this service

How can I resolve this? Please help!!!

Note: I have the global and regional endpoints under STS set to "valid in all AWS regions".

Caravan

Can you post "cluster.yaml" to your quesiton. – Malherbe

Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking. – Dietitian

Answer 1

mention --profile if you use any aws profile other than default

eksctl create cluster -f cluster.yaml --profile <profile-name>

Barbarize

Answer 2

In my case, it was a typo in the region. I had us-east1 as the value. When it is corrected to us-east-1, the error disappeared. So it is worth checking if there are typos in any of the fields.

Ripsaw

Answer 3

My SSO session token had expired:

aws sts get-caller-identity --profile default

The SSO session associated with this profile has expired or is otherwise invalid. To refresh this SSO session run aws sso login with the corresponding profile.

Then I needed to refresh my SSO session token:

aws sso login

Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-east-2.amazonaws.com/

Then enter the code:

XXXX-XXXX
Successfully logged into Start URL: https://XXXX.awsapps.com/start

Grizzled

I've forgoten to add the --profile {my-profile} – Sisterly

Answer 4

I was getting same error when trying to create cluster for the demo:

eksctl create cluster --name EKS-Cluster  --region eu-west-2a --node-type t2.small

The AZ was eu-west-2a' but needed to remove 'a' at the end of the AZ name. That resolved for me.

Dispraise

Answer 5

The eksctl tool doesn't substitute environment variables like:

region: ${AWS_REGION}

Which you placed in your cluster.yaml file.
Hardcode the region in your cluster.yaml file:

region: us-east-2

And the issue will go away.

Psi

Answer 6

Error: checking AWS STS access – cannot get role ARN for current session:

According to this, I think its not able to get the role (in your case, cluster creator's role) which is responsible to create the cluster. Create an IAM user with appropriate role. Attach necessary policies to that role to create the EKS cluster.
Then you can use aws configure command to add the AWS Access Key ID, AWS Secret Access Key, and Default region name.

[Make sure that the user has the appropriate access to create and access the eks cluster in your aws account. You can use aws cli to verify if you have the appropriate access]

Lindemann

Answer 7

It is important to configure the default profile for AWS CLI correctly on the command line using

set AWS_ACCESS_KEY_ID <your_access_key>

set AWS_SECRET_ACCESS_KEY <your_secret_key>

Nimble

Answer 8

Resolved in my case it show me this error enter image description here Solution - go to home directory open .aws folder check region i have update it as default and its resolved

Salve

Answer 9

In my case i just have to add --region eu-west-1 and it works. Just make sure you pass in the region flag

Frameup

Answer 10

My problem was that I was trying to work on a region which was not enabled for me

Apprehensive