{"record":{"id":"53ecb6acfab4d7b6","repo":"kubernetes/kops","slug":"error-updating-iamoidcprovider-thumbprints-v","errorCode":null,"errorMessage":"error updating IAMOIDCProvider Thumbprints: %v","messagePattern":"error updating IAMOIDCProvider Thumbprints: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":151,"sourceCode":"\t\t}\n\n\t\tresponse, err := t.Cloud.IAM().CreateOpenIDConnectProvider(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating IAMOIDCProvider: %v\", err)\n\t\t}\n\n\t\te.arn = response.OpenIDConnectProviderArn\n\t} else {\n\t\tif changes.Thumbprints != nil {\n\t\t\tklog.V(2).Infof(\"Updating IAMOIDCProvider Thumbprints %q\", fi.ValueOf(e.arn))\n\n\t\t\trequest := &iam.UpdateOpenIDConnectProviderThumbprintInput{}\n\t\t\trequest.OpenIDConnectProviderArn = a.arn\n\t\t\trequest.ThumbprintList = thumbprints\n\n\t\t\t_, err := t.Cloud.IAM().UpdateOpenIDConnectProviderThumbprint(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error updating IAMOIDCProvider Thumbprints: %v\", err)\n\t\t\t}\n\t\t}\n\t\tif changes.Tags != nil {\n\t\t\tif len(a.Tags) > 0 {\n\t\t\t\texistingTagKeys := make([]string, 0)\n\t\t\t\tfor k := range a.Tags {\n\t\t\t\t\texistingTagKeys = append(existingTagKeys, k)\n\t\t\t\t}\n\t\t\t\tuntagRequest := &iam.UntagOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tTagKeys:                  existingTagKeys,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().UntagOpenIDConnectProvider(ctx, untagRequest)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error untagging IAMOIDCProvider: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif len(e.Tags) > 0 {","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L133-L169","documentation":"Returned by IAMOIDCProvider.RenderAWS when UpdateOpenIDConnectProviderThumbprint fails while kOps refreshes the thumbprint list of an existing OIDC provider. kOps recalculates thumbprints (e.g. when the discovery host certificate changes) and pushes them via this API.","triggerScenarios":"UpdateOpenIDConnectProviderThumbprint fails: missing iam:UpdateOpenIDConnectProviderThumbprint permission, provider ARN not found (deleted concurrently), or throttling.","commonSituations":"OIDC discovery endpoint certificate rotated, triggering a thumbprint update on an account whose policy predates thumbprint-update support; provider removed by another tool between Find and Render; regional endpoints changes.","solutions":["Add iam:UpdateOpenIDConnectProviderThumbprint to the kOps IAM policy.","Confirm the provider ARN still exists in IAM; recreate via re-running kops apply if deleted.","Retry after transient throttling/network errors.","Verify the discovery endpoint TLS certificate is valid and reachable, since kOps fetches it to compute thumbprints."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify the provider ARN still exists and endpoint TLS is valid before updating thumbprints\nd, err := iamClient.GetOpenIDConnectProviderWithContext(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: arn})\nif err != nil { return err } // recreate provider first\nresp, err := http.Get(discoveryURL) // ensure TLS fetch succeeds so thumbprints are current","typeGuard":"func isThrottling(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == \"ThrottlingException\" || ae.ErrorCode() == \"TooManyRequestsException\") }","tryCatchPattern":"_, err := iamClient.UpdateOpenIDConnectProviderThumbprintWithContext(ctx, req)\nif err != nil {\n    if isThrottling(err) { return retryWithBackoff(ctx, op) }\n    return fmt.Errorf(\"error updating IAMOIDCProvider Thumbprints: %w\", err)\n}","preventionTips":["Grant iam:UpdateOpenIDConnectProviderThumbprint in the kOps policy","Keep discovery endpoint certificates valid and non-expired","Re-run apply after certificate rotation","Monitor CloudTrail for AccessDenied on thumbprint updates"],"tags":["aws","iam","oidc","tls","kops"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}