{"record":{"id":"3b21bb5b9f90e5e5","repo":"kubernetes/kops","slug":"error-listing-iam-role-policies-v","errorCode":null,"errorMessage":"error listing IAM role policies: %v","messagePattern":"error listing IAM role policies: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrole.go","lineNumber":176,"sourceCode":"\t\tklog.V(2).Infof(\"Deleting IAM role %q\", fi.ValueOf(a.Name))\n\n\t\tvar attachedPolicies []iamtypes.AttachedPolicy\n\t\tvar policyNames []string\n\n\t\t// List Inline policies\n\t\t{\n\t\t\trequest := &iam.ListRolePoliciesInput{\n\t\t\t\tRoleName: a.Name,\n\t\t\t}\n\t\t\tpaginator := iam.NewListRolePoliciesPaginator(t.Cloud.IAM(), request)\n\t\t\tfor paginator.HasMorePages() {\n\t\t\t\tpage, err := paginator.NextPage(ctx)\n\t\t\t\tif err != nil {\n\t\t\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\t\t\tklog.V(2).Infof(\"Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted\")\n\t\t\t\t\t\treturn nil\n\t\t\t\t\t}\n\t\t\t\t\treturn fmt.Errorf(\"error listing IAM role policies: %v\", err)\n\t\t\t\t}\n\t\t\t\tpolicyNames = append(policyNames, page.PolicyNames...)\n\t\t\t}\n\t\t}\n\n\t\t// List Attached Policies\n\t\t{\n\t\t\trequest := &iam.ListAttachedRolePoliciesInput{\n\t\t\t\tRoleName: a.Name,\n\t\t\t}\n\t\t\tpaginator := iam.NewListAttachedRolePoliciesPaginator(t.Cloud.IAM(), request)\n\t\t\tfor paginator.HasMorePages() {\n\t\t\t\tpage, err := paginator.NextPage(ctx)\n\t\t\t\tif err != nil {\n\t\t\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\t\t\tklog.V(2).Infof(\"Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted\")\n\t\t\t\t\t\treturn nil\n\t\t\t\t\t}","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrole.go#L158-L194","documentation":"During RenderAWS, kOps pages through ListRolePolicies to inventory the role's inline policies. Non-NoSuchEntity errors from the paginator are wrapped as 'error listing IAM role policies'. This indicates the AWS listing call itself failed.","triggerScenarios":"paginator.NextPage(ctx) on ListRolePolicies returns AccessDenied, throttling, or network error (NoSuchEntity is explicitly tolerated and treated as already-deleted).","commonSituations":"Missing iam:ListRolePolicies permission on the kOps controller; API throttling when reconciling many roles; transient AWS errors during large updates.","solutions":["Grant iam:ListRolePolicies (and GetRolePolicy) to the reconciling principal","Retry the update; add backoff if throttling (TooManyRequests) is the wrapped cause","Verify the role still exists and the RoleName passed to the paginator is correct","Check AWS service health if failures are broad"],"exampleFix":"// before\n{\"Effect\":\"Deny\",\"Action\":\"iam:List*\",\"Resource\":\"*\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"iam:ListRolePolicies\",\"iam:GetRolePolicy\"],\"Resource\":\"*\"}","handlingStrategy":"retry","validationCode":"// pre-check permission with a cheap call before paginating\n_, err := iamClient.ListRolePolicies(ctx, &iam.ListRolePoliciesInput{RoleName: roleName, MaxItems: aws.Int32(1)})\nif err != nil { /* access or role problem; resolve before full listing */ }","typeGuard":null,"tryCatchPattern":"page, err := paginator.NextPage(ctx)\nif err != nil {\n    if awsup.IsIAMNoSuchEntityException(err) { return nil }\n    var tme *types.ThrottlingException\n    if errors.As(err, &tme) { /* retry with exponential backoff */ }\n    return fmt.Errorf(\"error listing IAM role policies: %w\", err)\n}","preventionTips":["Grant iam:ListRolePolicies/GetRolePolicy to the reconciler","Add backoff for IAM throttling on large fleets","Confirm role existence before listing policies","Monitor IAM API error rates during updates"],"tags":["aws","iam","pagination","api-error"],"backgroundTag":"aws-iam-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}