{"record":{"id":"084192f3b8ab0b0c","repo":"kubernetes/kops","slug":"error-tagging-iamoidcprovider-v","errorCode":null,"errorMessage":"error tagging IAMOIDCProvider: %v","messagePattern":"error tagging IAMOIDCProvider: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":176,"sourceCode":"\t\t\t\t\texistingTagKeys = append(existingTagKeys, k)\n\t\t\t\t}\n\t\t\t\tuntagRequest := &iam.UntagOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tTagKeys:                  existingTagKeys,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().UntagOpenIDConnectProvider(ctx, untagRequest)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error untagging IAMOIDCProvider: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif len(e.Tags) > 0 {\n\t\t\t\ttagRequest := &iam.TagOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tTags:                     mapToIAMTags(e.Tags),\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().TagOpenIDConnectProvider(ctx, tagRequest)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error tagging IAMOIDCProvider: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif changes.ClientIDs != nil {\n\t\t\tactual := sets.NewString()\n\t\t\tfor _, aud := range a.ClientIDs {\n\t\t\t\tactual.Insert(aud)\n\t\t\t}\n\t\t\texpected := sets.NewString()\n\t\t\tfor _, aud := range e.ClientIDs {\n\t\t\t\texpected.Insert(aud)\n\t\t\t}\n\t\t\ttoRemove := actual.Difference(expected)\n\t\t\tfor _, elem := range toRemove.List() {\n\t\t\t\trequest := &iam.RemoveClientIDFromOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tClientID:                 &elem,\n\t\t\t\t}","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L158-L194","documentation":"Returned by IAMOIDCProvider.RenderAWS when TagOpenIDConnectProvider fails while applying desired tags to the OIDC provider. It pairs with the untag step: kOps diffs existing vs desired tags and applies additions via this call.","triggerScenarios":"TagOpenIDConnectProvider fails: missing iam:TagOpenIDConnectProvider permission, provider ARN no longer exists, invalid tag values (e.g. exceeding 256 chars or invalid prefix like reserved aws: keys), or throttling.","commonSituations":"Cluster spec tags including an 'aws:' prefixed key (reserved, rejected by IAM); overly long tag values from templating; policies not updated since tagging support was added.","solutions":["Remove reserved 'aws:' prefixed keys or invalid tag values from the cluster spec's tag configuration.","Grant iam:TagOpenIDConnectProvider to the kOps principal.","Verify the provider still exists and re-run apply.","Check tag limits (50 tags/provider, key ≤128 chars, value ≤256 chars)."],"exampleFix":"// before: reserved prefix rejected by IAM\nTags: map[string]string{\"aws:team\": \"platform\"}\n// after: use a custom prefix\nTags: map[string]string{\"team\": \"platform\"}","handlingStrategy":"validation","validationCode":"// validate tags against IAM constraints before calling TagOpenIDConnectProvider\nfor k, v := range tags {\n    if strings.HasPrefix(k, \"aws:\") { return fmt.Errorf(\"reserved tag key %q\", k) }\n    if len(k) > 128 || len(v) > 256 { return fmt.Errorf(\"tag %q exceeds IAM size limits\", k) }\n}\nif len(tags) > 50 { return errors.New(\"more than 50 tags\") }","typeGuard":"func isInvalidTag(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && strings.Contains(ae.ErrorCode(), \"Validation\") }","tryCatchPattern":null,"preventionTips":["Strip 'aws:' reserved prefixes from cluster-spec tags","Keep tag keys ≤128 chars and values ≤256 chars, max 50 tags","Grant iam:TagOpenIDConnectProvider to the kOps principal","Validate templated tag values before apply"],"tags":["aws","iam","oidc","tagging","kops"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}