{"record":{"id":"583d5853f7aa0dc7","repo":"kubernetes/kops","slug":"error-deleting-iam-oidc-provider-v-v","errorCode":null,"errorMessage":"error deleting IAM OIDC Provider %v: %v","messagePattern":"error deleting IAM OIDC Provider (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":2191,"sourceCode":"\treturn resourceTrackers, nil\n}\n\nfunc DeleteIAMOIDCProvider(cloud fi.Cloud, r *resources.Resource) error {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\tarn := new(r.ID)\n\t{\n\t\tklog.V(2).Infof(\"Deleting IAM OIDC Provider %v\", arn)\n\t\trequest := &iam.DeleteOpenIDConnectProviderInput{\n\t\t\tOpenIDConnectProviderArn: arn,\n\t\t}\n\t\t_, err := c.IAM().DeleteOpenIDConnectProvider(ctx, request)\n\t\tif err != nil {\n\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\tklog.V(2).Infof(\"Got NoSuchEntity deleting IAM OIDC Provider %v; will treat as already-deleted\", arn)\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error deleting IAM OIDC Provider %v: %v\", arn, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc ListSpotinstResources(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\treturn spotinst.ListResources(cloud.(awsup.AWSCloud).Spotinst(), clusterName)\n}\n\nfunc FindName(tags []ec2types.Tag) string {\n\tif name, found := awsup.FindEC2Tag(tags, \"Name\"); found {\n\t\treturn name\n\t}\n\treturn \"\"\n}\n\nfunc FindASGName(tags []autoscalingtypes.TagDescription) string {","sourceCodeStart":2173,"sourceCodeEnd":2209,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L2173-L2209","documentation":"kOps wraps the AWS SDK error from iam.DeleteOpenIDConnectProvider when deleting a cluster-owned OIDC provider. NoSuchEntity is already treated as success (already deleted), so this is a real delete failure such as AccessDenied or throttling. Because deletions are retried by kOps, DependencyApiError-style transient issues may resolve on re-run.","triggerScenarios":"DeleteOpenIDConnectProvider fails with AccessDenied (caller lacks iam:DeleteOpenIDConnectProvider), throttling, or the ARN was concurrently deleted by another process outside the NoSuchEntity window.","commonSituations":"Least-privilege deletion policies that grant delete on roles/buckets but forget the OIDC provider ARN; two operators running cluster deletion concurrently; org SCPs denying IAM deletes.","solutions":["Run `aws iam delete-open-id-connect-provider --open-id-connect-provider-arn <arn>` manually to see the raw cause","Add iam:DeleteOpenIDConnectProvider on the provider ARN to the caller's policy","If throttled or transient, re-run `kops delete cluster` — NoSuchEntity paths make deletion idempotent","Check for org SCPs / permission boundaries denying iam:Delete*"],"exampleFix":"// before: policy without OIDC delete\n{\"Effect\":\"Allow\",\"Action\":[\"iam:DeleteRole\",\"iam:DeleteRolePolicy\"],\"Resource\":\"*\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"iam:DeleteRole\",\"iam:DeleteRolePolicy\",\"iam:DeleteOpenIDConnectProvider\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// preflight: check the principal can delete the provider\nout, _ := iamClient.SimulatePrincipalPolicy(&iam.SimulatePrincipalPolicyInput{\n  PolicySourceArn: aws.String(operatorArn),\n  ActionNames: []string{\"iam:DeleteOpenIDConnectProvider\"},\n})\n// inspect out.EvaluationResults for denied decisions","typeGuard":"func isIAMDeleteDenied(err error) bool {\n  return strings.Contains(awsup.AWSErrorCode(err), \"AccessDenied\") || awsup.AWSErrorCode(err) == \"AccessDeniedException\"\n}","tryCatchPattern":"err := DeleteClusterOIDCProviders(ctx, cloud, clusterName)\nif err != nil {\n  if isIAMDeleteDenied(err) { klog.Warningf(\"manual cleanup required: %v\", err) }\n  else { return err }\n} // NoSuchEntity is already treated as success inside kOps","preventionTips":["Grant iam:DeleteOpenIDConnectProvider on the provider ARN pattern arn:aws:iam::*:oidc-provider/*","Check org SCPs before cluster teardown","Never run two cluster deletions concurrently","Re-run deletion; the flow is idempotent via NoSuchEntity handling"],"tags":["aws","iam","oidc","deletion"],"backgroundTag":"aws-iam-delete-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}