{"record":{"id":"62da21a02e00ac65","repo":"kubernetes/kops","slug":"failed-to-generate-aws-iam-policy-v","errorCode":null,"errorMessage":"failed to generate AWS IAM Policy: %v","messagePattern":"failed to generate AWS IAM Policy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/iam_builder.go","lineNumber":366,"sourceCode":"\tRole                                  Subject\n\tUseServiceAccountExternalPermisssions bool\n}\n\n// BuildAWSPolicy builds a set of IAM policy statements based on the\n// instance group type and IAM Legacy flag within the Cluster Spec\nfunc (b *PolicyBuilder) BuildAWSPolicy() (*Policy, error) {\n\t// Retrieve all the KMS Keys in use\n\tfor _, e := range b.Cluster.Spec.EtcdClusters {\n\t\tfor _, m := range e.Members {\n\t\t\tif m.KmsKeyID != nil {\n\t\t\t\tb.KMSKeys = append(b.KMSKeys, *m.KmsKeyID)\n\t\t\t}\n\t\t}\n\t}\n\n\tp, err := b.Role.BuildAWSPolicy(b)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate AWS IAM Policy: %v\", err)\n\t}\n\n\treturn p, nil\n}\n\nfunc NewPolicy(clusterName, partition, region string) *Policy {\n\tp := &Policy{\n\t\tVersion:                   PolicyDefaultVersion,\n\t\tclusterName:               clusterName,\n\t\tregion:                    region,\n\t\tunconditionalAction:       sets.New[string](),\n\t\tclusterTaggedAction:       sets.New[string](),\n\t\tclusterTaggedCreateAction: sets.New[string](),\n\t\tkmsDataPlaneAction:        sets.New[string](),\n\t\tpartition:                 partition,\n\t}\n\treturn p\n}","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/iam_builder.go#L348-L384","documentation":"This is the top-level wrapper error from PolicyBuilder.BuildAWSPolicy in kOps' IAM policy generator. It fires when the role-specific BuildAWSPolicy implementation (e.g. for NodeRoleAPIServer, NodeRoleMaster, NodeRoleBastion) returns an error while assembling the IAM policy statements for a cluster role. It is a generic wrap of a lower-level failure such as an unparseable state-store VFS path or an unsupported storage backend.","triggerScenarios":"Calling PolicyBuilder.BuildAWSPolicy() (typically via PolicyResource.Open during `kops update cluster` or `kops create cluster`) when the role's BuildAWSPolicy returns an error — concretely when AddS3Permissions fails because the cluster state store (S3Path) or etcd backup store cannot be parsed as a VFS path or is not a supported backend type.","commonSituations":"Malformed --state store URL (e.g. typo in s3:// scheme, unsupported VFS backend like azure:// when building AWS IAM policies); state store configured for a cloud whose path type has no AWS IAM mapping; corrupted cluster config where ConfigStore.Base is empty or invalid.","solutions":["Inspect the wrapped cause in the error message (the %v suffix) — it names the real failure (VFS parse error or 'path is not cluster readable').","Verify the state store URL: `kops get clusters --state <store>`; it must be a supported backend for AWS, typically s3://<bucket>.","Fix or recreate the cluster's configStore.base / etcd backupStore values in the cluster spec to valid s3:// paths.","If using tests or non-S3 filesystem paths, ensure the path type is one kOps can emulate (MemFSPath/FSPath are accepted; others are not)."],"exampleFix":"// before: malformed state store\nstateStore := \"s3:/my-bucket/cluster.example.com\" // missing slash -> BuildVfsPath fails\n// after\nstateStore := \"s3://my-bucket/cluster.example.com\"","handlingStrategy":"validation","validationCode":"// Before generating IAM policies, validate the state store parses\nstore := os.Getenv(\"KOPS_STATE_STORE\")\nif _, err := vfs.Context.BuildVfsPath(store); err != nil {\n    return fmt.Errorf(\"invalid KOPS_STATE_STORE %q: %w\", store, err)\n}","typeGuard":"// Ensure the resolved path type is supported for AWS IAM\nif _, ok := vfsPath.(*vfs.S3Path); !ok {\n    return fmt.Errorf(\"state store must be s3:// for AWS IAM, got %T\", vfsPath)\n}","tryCatchPattern":"p, err := builder.BuildAWSPolicy()\nif err != nil {\n    if strings.Contains(err.Error(), \"cannot parse VFS path\") {\n        // fix state store URL, then retry\n    }\n    return fmt.Errorf(\"BuildAWSPolicy: %w\", err)\n}","preventionTips":["Always pass fully-qualified s3:// URLs as KOPS_STATE_STORE for AWS clusters","Run `kops get clusters` once before update to validate the store parses","Never hand-edit configStore.base without validating the URL","Pin kOps version to match the cluster spec version"],"tags":["aws","iam","kops","policy-generation"],"backgroundTag":"iam-policy-generation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}