{"record":{"id":"3111b03d36da4861","repo":"kubernetes/kops","slug":"error-checking-iam-for-project-s-w","errorCode":null,"errorMessage":"error checking IAM for project %s: %w","messagePattern":"error checking IAM for project (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/projectiambinding.go","lineNumber":64,"sourceCode":"}\n\nfunc (e *ProjectIAMBinding) Find(c *fi.CloudupContext) (*ProjectIAMBinding, error) {\n\tctx := context.TODO()\n\n\tcloud := c.T.Cloud.(gce.GCECloud)\n\n\tprojectID := fi.ValueOf(e.Project)\n\tmember := \"serviceAccount:\" + fi.ValueOf(e.MemberServiceAccount.Email)\n\trole := fi.ValueOf(e.Role)\n\n\tklog.V(2).Infof(\"Checking IAM for project %q\", projectID)\n\toptions := &cloudresourcemanager.GetIamPolicyRequest{Options: &cloudresourcemanager.GetPolicyOptions{RequestedPolicyVersion: 3}}\n\tpolicy, err := cloud.CloudResourceManager().Projects.GetIamPolicy(projectID, options).Context(ctx).Do()\n\tif err != nil {\n\t\tif gce.IsNotFound(err) {\n\t\t\treturn nil, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"error checking IAM for project %s: %w\", projectID, err)\n\t}\n\n\tchanged := patchCRMPolicy(policy, member, role)\n\tif changed {\n\t\treturn nil, nil\n\t}\n\n\tactual := &ProjectIAMBinding{}\n\tactual.Project = e.Project\n\tactual.MemberServiceAccount = e.MemberServiceAccount\n\tactual.Role = e.Role\n\n\t// Ignore \"system\" fields\n\tactual.Name = e.Name\n\tactual.Lifecycle = e.Lifecycle\n\n\treturn actual, nil\n}","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/projectiambinding.go#L46-L82","documentation":"Wrapped error from ProjectIAMBinding.Find when CloudResourceManager Projects.GetIamPolicy fails while checking whether the member already holds the role. Causes include missing resourcemanager.projects.getIamPolicy permission, an invalid project ID, or API errors.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gcetasks/projectiambinding.go:64 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped error for the API reason","Verify the project ID and the service account's CRM permissions","Retry on transient Cloud Resource Manager failures"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}