{"record":{"id":"275b31892b246b80","repo":"kubernetes/kops","slug":"listing-iam-roles-w","errorCode":null,"errorMessage":"listing IAM roles: %w","messagePattern":"listing IAM roles: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/iam.go","lineNumber":475,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tpolicy = strings.ReplaceAll(NodeRolePolicyTemplate, \"{{ IAMServiceEC2 }}\", ec2Service)\n\t}\n\n\treturn fi.NewStringResource(policy), nil\n}\n\nfunc (b *IAMModelBuilder) FindDeletions(context *fi.CloudupModelBuilderContext, cloud fi.Cloud) error {\n\tctx := context.Context()\n\tiamapi := cloud.(awsup.AWSCloud).IAM()\n\townershipTag := \"kubernetes.io/cluster/\" + b.Cluster.ObjectMeta.Name\n\trequest := &awsiam.ListRolesInput{}\n\tpaginator := awsiam.NewListRolesPaginator(iamapi, request)\n\tfor paginator.HasMorePages() {\n\t\tpage, err := paginator.NextPage(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"listing IAM roles: %w\", err)\n\t\t}\n\t\tfor _, role := range page.Roles {\n\t\t\tif !strings.HasSuffix(fi.ValueOf(role.RoleName), \".\"+b.Cluster.ObjectMeta.Name) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tgetRequest := &awsiam.GetRoleInput{RoleName: role.RoleName}\n\t\t\troleOutput, err := iamapi.GetRole(ctx, getRequest)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"calling IAM GetRole on %s: %w\", fi.ValueOf(role.RoleName), err)\n\t\t\t}\n\t\t\tfor _, tag := range roleOutput.Role.Tags {\n\t\t\t\tif fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == \"owned\" {\n\t\t\t\t\tif _, ok := context.Tasks[\"IAMRole/\"+fi.ValueOf(role.RoleName)]; !ok {\n\t\t\t\t\t\tcontext.AddTask(&awstasks.IAMRole{\n\t\t\t\t\t\t\tID:        role.RoleId,\n\t\t\t\t\t\t\tName:      role.RoleName,\n\t\t\t\t\t\t\tLifecycle: b.Lifecycle,\n\t\t\t\t\t\t})","sourceCodeStart":457,"sourceCodeEnd":493,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/iam.go#L457-L493","documentation":"The paginated ListRoles call against AWS IAM failed while discovering roles to delete; an AWS API error such as throttling, credentials, or permissions on iam:ListRoles.","triggerScenarios":"Thrown at pkg/model/awsmodel/iam.go:475 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check AWS credentials and iam:ListRoles permissions","Retry — IAM throttling is common","Verify the AWS partition configuration"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}