{"record":{"id":"69219abda468d84f","repo":"kubernetes/kops","slug":"error-getting-iam-oidc-provider-q-w","errorCode":null,"errorMessage":"error getting IAM OIDC Provider %q: %w","messagePattern":"error getting IAM OIDC Provider %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":2152,"sourceCode":"\t\tresponse, err := c.IAM().ListOpenIDConnectProviders(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing IAM OIDC Providers: %v\", err)\n\t\t}\n\t\tfor _, provider := range response.OpenIDConnectProviderList {\n\t\t\tarn := provider.Arn\n\t\t\tdescReq := &iam.GetOpenIDConnectProviderInput{\n\t\t\t\tOpenIDConnectProviderArn: arn,\n\t\t\t}\n\t\t\tresp, err := c.IAM().GetOpenIDConnectProvider(ctx, descReq)\n\t\t\tif err != nil {\n\t\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\t\tklog.Warningf(\"could not find IAM OIDC Provider %q. Resource may already have been deleted: %v\", aws.ToString(arn), err)\n\t\t\t\t\tcontinue\n\t\t\t\t} else if awsup.AWSErrorCode(err) == \"403\" {\n\t\t\t\t\tklog.Warningf(\"failed to determine ownership of %q: %v\", aws.ToString(arn), err)\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\treturn nil, fmt.Errorf(\"error getting IAM OIDC Provider %q: %w\", aws.ToString(arn), err)\n\t\t\t}\n\t\t\tif !matchesIAMTags(tags, resp.Tags) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tproviders = append(providers, arn)\n\t\t}\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\n\tfor _, arn := range providers {\n\t\tresourceTracker := &resources.Resource{\n\t\t\tName:    aws.ToString(arn),\n\t\t\tID:      aws.ToString(arn),\n\t\t\tType:    \"oidc-provider\",\n\t\t\tDeleter: DeleteIAMOIDCProvider,\n\t\t}\n\t\tresourceTrackers = append(resourceTrackers, resourceTracker)","sourceCodeStart":2134,"sourceCodeEnd":2170,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L2134-L2170","documentation":"kOps wraps the AWS SDK error from iam.GetOpenIDConnectProvider when fetching tags to determine ownership. NoSuchEntity and 403 are already skipped with warnings, so this is an unexpected per-provider failure (e.g. throttling). Only the current provider's ownership check is aborted because the function returns nil, err.","triggerScenarios":"GetOpenIDConnectProvider fails with a code other than NoSuchEntity/'403': TooManyRequests throttling, serialized request errors, permissions edge cases where the error code string isn't exactly '403'.","commonSituations":"Many OIDC providers in the account causing Get-call throttling during listing; provider deleted concurrently with a race not matching NoSuchEntity (rare); restricted STS session policies.","solutions":["Inspect the wrapped error code (errors.As on *types.NoSuchEntityException or smithy APIError)","If throttled, retry with exponential backoff","Re-run the operation; if the provider is gone, the error should now be NoSuchEntity and be skipped","Verify IAM permissions for iam:GetOpenIDConnectProvider"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight one provider Get to confirm permission before scanning all\nif len(providers) > 0 {\n  _, err := iamClient.GetOpenIDConnectProvider(ctx, &iam.GetOpenIDConnectProviderInput{OpenIDConnectProviderArn: providers[0]})\n  if err != nil && awsup.AWSErrorCode(err) != \"NoSuchEntity\" { return err }\n}","typeGuard":"func isThrottleOrTransient(err error) bool {\n  code := awsup.AWSErrorCode(err)\n  return code == \"ThrottlingException\" || code == \"TooManyRequests\" || code == \"RequestLimitExceeded\"\n}","tryCatchPattern":"arns, err := ListClusterOIDCProviders(ctx, cloud, clusterName)\nif err != nil && isThrottleOrTransient(err) {\n  // backoff and retry the listing\n} else if err != nil {\n  return err\n}","preventionTips":["Add backoff between Get calls when accounts have many OIDC providers","Treat NoSuchEntity and 403 as skip (kOps already does) — only retry throttle codes","Verify ownership-tag conventions match what kOps writes","Keep session policies from silently dropping iam:Get* permissions"],"tags":["aws","iam","oidc","ownership-tags"],"backgroundTag":"aws-iam-get-oidc-provider-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}