{"record":{"id":"0279f59aa1df9a78","repo":"kubernetes/kops","slug":"error-detaching-iam-role-policy-q-v","errorCode":null,"errorMessage":"error detaching IAM role policy %q: %v","messagePattern":"error detaching IAM role policy %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrole.go","lineNumber":223,"sourceCode":"\t\t\t\tRoleName:   a.Name,\n\t\t\t\tPolicyName: aws.String(policyName),\n\t\t\t}\n\t\t\t_, err := t.Cloud.IAM().DeleteRolePolicy(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error deleting IAM role policy %q: %v\", policyName, err)\n\t\t\t}\n\t\t}\n\n\t\t// Detach Managed Policies\n\t\tfor _, policy := range attachedPolicies {\n\t\t\tklog.V(2).Infof(\"Detaching IAM role policy %v\", policy)\n\t\t\trequest := &iam.DetachRolePolicyInput{\n\t\t\t\tRoleName:  a.Name,\n\t\t\t\tPolicyArn: policy.PolicyArn,\n\t\t\t}\n\t\t\t_, err := t.Cloud.IAM().DetachRolePolicy(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error detaching IAM role policy %q: %v\", *policy.PolicyArn, err)\n\t\t\t}\n\t\t}\n\n\t\trequest := &iam.DeleteRoleInput{\n\t\t\tRoleName: a.Name,\n\t\t}\n\t\tif _, err := t.Cloud.IAM().DeleteRole(ctx, request); err != nil {\n\t\t\treturn fmt.Errorf(\"error deleting IAM role: %v\", err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tpolicy, err := fi.ResourceAsString(e.RolePolicyDocument)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error rendering RolePolicyDocument: %v\", err)\n\t}\n\n\tif a == nil {","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrole.go#L205-L241","documentation":"kOps' IAMRole.RenderAWS detaches every policy attached to a role before deleting it. When the AWS IAM DetachRolePolicy call fails for any attached policy, the underlying SDK error is wrapped as 'error detaching IAM role policy %q: %v' and reconciliation of the task aborts. The %q is the policy ARN being detached.","triggerScenarios":"DetachRolePolicy returns NoSuchEntity (role or policy already gone), DeleteConflict (role still in use by an instance profile or the policy cannot be detached), AccessDenied (credentials lack iam:DetachRolePolicy), or an IAM throttling/propagation error right after role creation.","commonSituations":"Deleting a cluster whose role is still attached to an instance profile created outside kOps; a manually created service-linked or shared policy; IAM eventual-consistency delay after policy creation; restricted CI credentials; policy ARNs changed between kOps versions.","solutions":["Resolve the DeleteConflict: disassociate any instance profiles using the role, then rerun kOps","Check for NoSuchEntity in the wrapped error and re-run apply so kOps refreshes state","Grant the credentials iam:DetachRolePolicy (and iam:ListAttachedRolePolicies)","Retry after a short delay — IAM propagation after creation often causes transient failures"],"exampleFix":"// before: blindly retry apply\nkops update cluster --yes\n\n// after: clear the conflict first\naws iam list-instance-profiles-for-role --role-name masters.example.com\naws iam remove-role-from-instance-profile --instance-profile-name X --role-name masters.example.com\nkops update cluster --yes","handlingStrategy":"try-catch","validationCode":"for _, p := range attachedPolicies {\n    if p.PolicyArn == policyARNToDelete {\n        conflict = listInstanceProfilesForRole(roleName) // must be empty before delete\n    }\n}\nif conflict != nil { return fmt.Errorf(\"role %s still in use\", roleName) }","typeGuard":null,"tryCatchPattern":"// kOps flattens the AWS error to a string, so match on content\nif strings.Contains(err.Error(), \"DeleteConflict\") {\n    // disassociate instance profiles, then retry apply\n} else if strings.Contains(err.Error(), \"NoSuchEntity\") {\n    // already detached; safe to continue\n}","preventionTips":["Before teardown, run aws iam list-instance-profiles-for-role and clear associations","Ensure CI credentials include iam:DetachRolePolicy","Space out apply/delete operations to avoid IAM propagation windows","Read kOps release notes for IAM policy ARN changes between versions"],"tags":["aws","iam","go","kops"],"backgroundTag":"aws-iam-delete-conflict","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}