{"record":{"id":"2a57725b60a37855","repo":"kubernetes/kops","slug":"error-listing-iam-role-policies-for-v","errorCode":null,"errorMessage":"error listing IAM role policies for %v","messagePattern":"error listing IAM role policies for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrole.go","lineNumber":195,"sourceCode":"\t\t\t\t}\n\t\t\t\tpolicyNames = append(policyNames, page.PolicyNames...)\n\t\t\t}\n\t\t}\n\n\t\t// List Attached Policies\n\t\t{\n\t\t\trequest := &iam.ListAttachedRolePoliciesInput{\n\t\t\t\tRoleName: a.Name,\n\t\t\t}\n\t\t\tpaginator := iam.NewListAttachedRolePoliciesPaginator(t.Cloud.IAM(), request)\n\t\t\tfor paginator.HasMorePages() {\n\t\t\t\tpage, err := paginator.NextPage(ctx)\n\t\t\t\tif err != nil {\n\t\t\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\t\t\tklog.V(2).Infof(\"Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted\")\n\t\t\t\t\t\treturn nil\n\t\t\t\t\t}\n\t\t\t\t\treturn fmt.Errorf(\"error listing IAM role policies for %v\", err)\n\t\t\t\t}\n\t\t\t\tattachedPolicies = append(attachedPolicies, page.AttachedPolicies...)\n\t\t\t}\n\t\t}\n\n\t\t// Delete inline policies\n\t\tfor _, policyName := range policyNames {\n\t\t\tklog.V(2).Infof(\"Deleting IAM role policy %q\", policyName)\n\t\t\trequest := &iam.DeleteRolePolicyInput{\n\t\t\t\tRoleName:   a.Name,\n\t\t\t\tPolicyName: aws.String(policyName),\n\t\t\t}\n\t\t\t_, err := t.Cloud.IAM().DeleteRolePolicy(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error deleting IAM role policy %q: %v\", policyName, err)\n\t\t\t}\n\t\t}\n","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrole.go#L177-L213","documentation":"RenderAWS similarly pages through ListAttachedRolePolicies to inventory managed policies attached to the role. A non-NoSuchEntity error from the paginator is wrapped with this message. Note the format verb only prints the error, not the role, so correlate via surrounding logs.","triggerScenarios":"paginator.NextPage(ctx) on ListAttachedRolePolicies returns AccessDenied, throttling, or a transient AWS error (NoSuchEntity is tolerated).","commonSituations":"Controller policy lacks iam:ListAttachedRolePolicies; throttling during large reconciliations; role deleted concurrently by another process mid-render.","solutions":["Add iam:ListAttachedRolePolicies to the caller's IAM policy","Retry if the wrapped error is throttling; spread reconciliation load","Confirm the role exists (list roles) in case it was deleted concurrently","Enable klog V(2) for context on which task/role was being rendered"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-flight permission check\n_, err := iamClient.ListAttachedRolePolicies(ctx, &iam.ListAttachedRolePoliciesInput{RoleName: roleName, MaxItems: aws.Int32(1)})\nif err != nil { /* fix access or role state before reconcile */ }","typeGuard":null,"tryCatchPattern":"page, err := paginator.NextPage(ctx)\nif err != nil {\n    if awsup.IsIAMNoSuchEntityException(err) { return nil }\n    var tme *types.ThrottlingException\n    if errors.As(err, &tme) { /* retry with backoff */ }\n    return fmt.Errorf(\"error listing attached policies for role: %w\", err)\n}","preventionTips":["Grant iam:ListAttachedRolePolicies to the kOps controller","Retry idempotent listing on throttling","Include the role name in wrapped errors for faster triage","Avoid concurrent reconcilers on the same roles"],"tags":["aws","iam","pagination","api-error"],"backgroundTag":"aws-iam-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}