diff --git a/pkg/aws/sts/arn_resolver.go b/pkg/aws/sts/arn_resolver.go
index ea2f4052..2103f358 100644
--- a/pkg/aws/sts/arn_resolver.go
+++ b/pkg/aws/sts/arn_resolver.go
@@ -30,6 +30,10 @@ func DefaultResolver(prefix string) *Resolver {
 
 // Resolve converts from a role string into the absolute role arn.
 func (r *Resolver) Resolve(role string) string {
+	if role == "" {
+		return ""
+	}
+
 	if strings.HasPrefix(role, "/") {
 		role = strings.TrimPrefix(role, "/")
 	}
diff --git a/pkg/aws/sts/arn_resolver_test.go b/pkg/aws/sts/arn_resolver_test.go
index 51e16c3c..f3645cbe 100644
--- a/pkg/aws/sts/arn_resolver_test.go
+++ b/pkg/aws/sts/arn_resolver_test.go
@@ -26,6 +26,15 @@ func TestAddsPrefix(t *testing.T) {
 	}
 }
 
+func TestReturnsEmpty(t *testing.T) {
+	resolver := DefaultResolver("arn:aws:iam::account-id:role/")
+	role := resolver.Resolve("")
+
+	if role != "" {
+		t.Error("unexpected role, was:", role)
+	}
+}
+
 func TestAddsPrefixWithRoleBeginningWithSlash(t *testing.T) {
 	resolver := DefaultResolver("arn:aws:iam::account-id:role/")
 	role := resolver.Resolve("/myrole")
diff --git a/pkg/server/server.go b/pkg/server/server.go
index eed99d2c..7a0642e0 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -33,7 +33,7 @@ import (
 	pb "github.com/uswitch/kiam/proto"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
-	"k8s.io/api/core/v1"	
+	"k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/scheme"