{"record":{"id":"2de289298061e3ed","repo":"kubernetes/kops","slug":"error-creating-updating-iamrolepolicy-v","errorCode":null,"errorMessage":"error creating/updating IAMRolePolicy: %v","messagePattern":"error creating/updating IAMRolePolicy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":282,"sourceCode":"\t\t\t\tklog.V(2).Infof(\"diff: %s\", d)\n\t\t\t}\n\n\t\t\tdoPut = true\n\t\t}\n\t}\n\n\tif doPut {\n\t\trequest := &iam.PutRolePolicyInput{}\n\t\trequest.PolicyDocument = aws.String(policy)\n\t\trequest.RoleName = e.Role.Name\n\t\trequest.PolicyName = e.Name\n\n\t\tklog.V(8).Infof(\"PutRolePolicy RoleName=%s PolicyName=%s: %s\", aws.ToString(e.Role.Name), aws.ToString(e.Name), policy)\n\n\t\t_, err = t.Cloud.IAM().PutRolePolicy(ctx, request)\n\t\tif err != nil {\n\t\t\tklog.V(2).Infof(\"PutRolePolicy RoleName=%s PolicyName=%s: %s\", aws.ToString(e.Role.Name), aws.ToString(e.Name), policy)\n\t\t\treturn fmt.Errorf(\"error creating/updating IAMRolePolicy: %v\", err)\n\t\t}\n\t}\n\n\t// TODO: Should we use path as our tag?\n\treturn nil // No tags in IAM\n}\n\nfunc (e *IAMRolePolicy) policyDocumentString() (string, error) {\n\tif e.PolicyDocument == nil {\n\t\treturn \"\", nil\n\t}\n\n\tpolicy, err := fi.ResourceAsString(e.PolicyDocument)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tpolicySize := len(strings.Join(strings.Fields(policy), \"\"))\n\tif policySize > 10240 {","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L264-L300","documentation":"RenderAWS calls the AWS IAM PutRolePolicy API to create or update the inline role policy, and the SDK returned an error. kOps wraps it verbatim so the underlying AWS error (e.g. LimitExceeded, NoSuchEntity, AccessDenied) is preserved. The apply for this task fails; retrying the apply will resume.","triggerScenarios":"IAM PutRolePolicy returns any error: role does not exist yet/was deleted (NoSuchEntity), caller lacks iam:PutRolePolicy permission, policy size exceeds the IAM limit at the service side, throttling, or credential/STS problems.","commonSituations":"Using credentials without iam:Put* permissions; deleting/recreating an IAMRole in the same apply so the policy attaches to a missing role; AWS API throttling on large clusters; malformed policy rejected by IAM (MalformedPolicyDocument).","solutions":["Read the wrapped AWS error code and fix accordingly (permissions, missing role, malformed policy).","Ensure the IAMRole task is applied before the IAMRolePolicy (single apply usually handles ordering; re-run kops update).","Check that the policy JSON is valid and under 10240 bytes before applying.","Retry the apply after a short wait if the error was throttling."],"exampleFix":"// before: policy rejected by IAM\n{\"Version\":\"2012-...\",\"Statement\":[{\"Effect\":\"allow\", ...}]}  // lowercase effect invalid\n// after\n{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\"],\"Resource\":\"*\"}]}","handlingStrategy":"try-catch","validationCode":"// pre-check IAM permissions\niamSim := iam.SimulatePrincipalPolicyInput{PolicySourceArn: callerArn, ActionNames: []string{\"iam:PutRolePolicy\"}}","typeGuard":"var awsErr smithy.APIError\nif errors.As(err, &awsErr) {\n  switch awsErr.ErrorCode() {\n  case \"NoSuchEntity\": // role missing\n  case \"AccessDenied\": // permissions\n  case \"Throttling\": // retry\n  }\n}","tryCatchPattern":"err := cli.UpdateCluster(ctx, opts)\nvar apiErr smithy.APIError\nif errors.As(err, &apiErr) && apiErr.ErrorCode() == \"ThrottlingException\" {\n  time.Sleep(backoff); retry()\n}","preventionTips":["Grant the operator credentials iam:PutRolePolicy/GetRolePolicy/DeleteRolePolicy.","Avoid deleting and recreating a role and its policies in separate applies.","Compact policies client-side before apply.","Use CloudTrail to confirm which IAM API call was rejected."],"tags":["aws","iam","api-error","kops-apply"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}