{"record":{"id":"446e5fbbfe935d04","repo":"kubernetes/kops","slug":"error-rendering-rolepolicydocument-v-446e5f","errorCode":null,"errorMessage":"error rendering RolePolicyDocument: %v","messagePattern":"error rendering RolePolicyDocument: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/sqs.go","lineNumber":213,"sourceCode":"func (q *SQS) CheckChanges(a, e, changes *SQS) error {\n\tif a == nil {\n\t\tif e.Name == nil {\n\t\t\treturn field.Required(field.NewPath(\"Name\"), \"\")\n\t\t}\n\t}\n\tif a != nil {\n\t\tif changes.URL != nil {\n\t\t\treturn fi.CannotChangeField(\"URL\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (q *SQS) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *SQS) error {\n\tctx := context.TODO()\n\tpolicy, err := fi.ResourceAsString(e.Policy)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error rendering RolePolicyDocument: %v\", err)\n\t}\n\n\tif a == nil {\n\t\trequest := &sqs.CreateQueueInput{\n\t\t\tAttributes: map[string]string{\n\t\t\t\t\"MessageRetentionPeriod\": strconv.Itoa(q.MessageRetentionPeriod),\n\t\t\t\t\"Policy\":                 policy,\n\t\t\t},\n\t\t\tQueueName: q.Name,\n\t\t\tTags:      q.Tags,\n\t\t}\n\t\tresponse, err := t.Cloud.SQS().CreateQueue(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating SQS queue: %v\", err)\n\t\t}\n\n\t\tattributes, err := t.Cloud.SQS().GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{\n\t\t\tAttributeNames: []sqstypes.QueueAttributeName{sqstypes.QueueAttributeNameQueueArn},","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/sqs.go#L195-L231","documentation":"In kOps' AWS task renderer for SQS queues, the task's Policy resource (the queue's IAM policy document) is rendered to a string before creating/updating the queue. If that resource cannot be materialized (e.g. a file-based or delegated resource fails to load), RenderAWS aborts with \"error rendering RolePolicyDocument\". The underlying cause is always wrapped in the %v suffix.","triggerScenarios":"fi.ResourceAsString(e.Policy) returns an error: the Policy resource is nil-backed, the referenced local policy file is missing/unreadable, or a ResourceHolder was never resolved with an actual value before render.","commonSituations":"Cluster spec references an external policy file that doesn't exist on disk; a custom addon hook supplies an empty policy; a templated policy resource fails during delegation; running kOps from a different working directory so relative policy paths break.","solutions":["Inspect the wrapped error text after the colon to find the real cause (file not found, empty resource, etc.).","Verify the Policy resource path/file exists and is readable from where kOps runs.","Ensure the task spec always sets Policy (e.g. fi.NewStringResource(policyJSON)) before render.","If generating policy programmatically, validate the JSON builds without error before assigning it to the task."],"exampleFix":"// before\nPolicy: fi.NewResourceHolder(...) // never resolved\n// after\npolicyJSON, err := buildQueuePolicy(cluster)\nif err != nil { return err }\ne.Policy = fi.NewStringResource(policyJSON)","handlingStrategy":"validation","validationCode":"if task.Policy == nil { return fmt.Errorf(\"SQS task %s has no Policy set\", fi.ValueOf(task.Name)) }\nif _, err := fi.ResourceAsString(task.Policy); err != nil {\n    return fmt.Errorf(\"policy for queue %s cannot be rendered: %w\", fi.ValueOf(task.Name), err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always construct Policy with fi.NewStringResource from validated JSON.","Pre-validate policy files exist before building the cluster spec.","Log the rendered policy in dry-run (kops edit cluster / --dry-run) before applying."],"tags":["aws","sqs","iam-policy","render"],"backgroundTag":"resource-render-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}