Error: checking AWS STS access – cannot get role ARN for current session: MissingEndpoint: 'Endpoint' configuration is required for this service

Question

I created a cluster.yaml file which contains the below information:

---
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: eks-litmus-demo
  region: ${AWS_REGION}
  version: "1.21"
managedNodeGroups:
  - instanceType: m5.large
    amiFamily: AmazonLinux2
    name: eks-litmus-demo-ng
    desiredCapacity: 2
    minSize: 2
    maxSize: 4
EOF

When i run $ eksctl create cluster -f cluster.yaml to create the cluster through my terminal, I get the below error:

Error: checking AWS STS access – cannot get role ARN for current session: MissingEndpoint: 'Endpoint' configuration is required for this service

How can I resolve this? Please help!!!

Note: I have the global and regional endpoints under STS set to "valid in all AWS regions".

Answer 1

In my case, it was a typo in the region. I had us-east1 as the value. When it is corrected to us-east-1 , the error disappeared. So it is worth checking if there are typos in any of the fields.

Answer 2

My SSO session token had expired:

aws sts get-caller-identity --profile default

The SSO session associated with this profile has expired or is otherwise invalid. To refresh this SSO session run aws sso login with the corresponding profile.

Then I needed to refresh my SSO session token:

aws sso login

Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-east-2.amazonaws.com/

Then enter the code:

XXXX-XXXX
Successfully logged into Start URL: https://XXXX.awsapps.com/start

Answer 3

Error: checking AWS STS access – cannot get role ARN for current session:

According to this, I think its not able to get the role (in your case, cluster creator's role) which is responsible to create the cluster. Create an IAM user with appropriate role. Attach necessary policies to that role to create the EKS cluster.
Then you can use aws configure command to add the AWS Access Key ID , AWS Secret Access Key , and Default region name .

[Make sure that the user has the appropriate access to create and access the eks cluster in your aws account. You can use aws cli to verify if you have the appropriate access]

Answer 4

mention --profile if you use any aws profile other than default

 eksctl create cluster -f cluster.yaml --profile <profile-name>

Answer 5

It is important to configure the default profile for AWS CLI correctly on the command line using

set AWS_ACCESS_KEY_ID <your_access_key>

set AWS_SECRET_ACCESS_KEY <your_secret_key>