{"record":{"id":"1d7d1252ed5b2fe4","repo":"kubernetes/kops","slug":"error-reading-actual-policy-document-v-1d7d12","errorCode":null,"errorMessage":"error reading actual policy document: %v","messagePattern":"error reading actual policy document: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":257,"sourceCode":"\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error deleting IAMRolePolicy: %v\", err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tdoPut := false\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating IAMRolePolicy\")\n\t\tdoPut = true\n\t} else if changes != nil {\n\t\tif changes.PolicyDocument != nil {\n\t\t\tklog.V(2).Infof(\"Applying changed role policy to %q:\", *e.Name)\n\n\t\t\tactualPolicy, err := a.policyDocumentString()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error reading actual policy document: %v\", err)\n\t\t\t}\n\n\t\t\tif actualPolicy == policy {\n\t\t\t\tklog.Warning(\"Policies were actually the same\")\n\t\t\t} else {\n\t\t\t\td := diff.FormatDiff(actualPolicy, policy)\n\t\t\t\tklog.V(2).Infof(\"diff: %s\", d)\n\t\t\t}\n\n\t\t\tdoPut = true\n\t\t}\n\t}\n\n\tif doPut {\n\t\trequest := &iam.PutRolePolicyInput{}\n\t\trequest.PolicyDocument = aws.String(policy)\n\t\trequest.RoleName = e.Role.Name\n\t\trequest.PolicyName = e.Name","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L239-L275","documentation":"During RenderAWS of an IAMRolePolicy, when the task has changes to apply, kOps re-reads the current inline policy from IAM via policyDocumentString() to compare with the desired policy before diffing/updating. This error wraps any failure of that read — most commonly the resource rendering of PolicyDocument or the local 10240-byte size guard inside policyDocumentString(). It aborts the apply for this task without modifying the IAM role policy.","triggerScenarios":"Apply with changes to an IAMRolePolicy where fi.ResourceAsString(e.PolicyDocument) fails (unreadable/nil PolicyDocument resource), or the serialized policy exceeds 10240 bytes (the size guard inside policyDocumentString returns its own error which is wrapped here).","commonSituations":"Oversized inline role policies after adding many permissions; a PolicyDocument resource whose backing file/asset cannot be read at apply time; corrupted or empty policy resource after a partial build.","solutions":["Check the wrapped inner error (%v) — if it reports policy size, trim statements or move permissions to a managed policy.","Validate the PolicyDocument JSON is well-formed and readable before running kops update.","Re-run kops update with --v=2 to see which role policy failed and inspect the cluster spec's additionalPolicies.","Split the policy into a separately managed IAM managed policy and attach it by ARN."],"exampleFix":"// before: one huge inline policy in cluster spec\nadditionalPolicies: [ <11KB JSON> ]\n// after: trim or attach a managed policy\nadditionalPolicies: [ <condensed JSON with combined actions, wildcard resources where safe> ]","handlingStrategy":"validation","validationCode":"policy, err := fi.ResourceAsString(task.PolicyDocument)\nif err != nil { return err }\nif len(strings.Join(strings.Fields(policy), \"\")) > 10240 { return fmt.Errorf(\"policy too large: %d bytes\", len(policy)) }","typeGuard":null,"tryCatchPattern":"// kops CLI: wrap the update call\nif err := applyCluster(ctx, cluster); err != nil {\n  if strings.Contains(err.Error(), \"error reading actual policy document\") {\n    klog.Errorf(\"IAM role policy unreadable/oversized: %v\", err)\n  }\n  return err\n}","preventionTips":["Keep inline role policies well under 10240 bytes; use managed policies for large permission sets.","Validate policy JSON with `jq empty` before committing it to the cluster spec.","Run `kops update --target=terraform` as a dry-run to catch policy problems before applying.","Lint IAM policies with access-analyzer or cfn-policy-validator."],"tags":["aws","iam","policy-document","kops-apply"],"backgroundTag":"iam-policy-document-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}