{"record":{"id":"7b58d56f9b4482d8","repo":"kubernetes/kops","slug":"error-rendering-policydocument-v","errorCode":null,"errorMessage":"error rendering PolicyDocument: %v","messagePattern":"error rendering PolicyDocument: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":161,"sourceCode":"}\n\nfunc (e *IAMRolePolicy) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (s *IAMRolePolicy) CheckChanges(a, e, changes *IAMRolePolicy) error {\n\tif a != nil {\n\t\tif e.Name == nil {\n\t\t\treturn fi.RequiredField(\"Name\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (_ *IAMRolePolicy) ShouldCreate(a, e, changes *IAMRolePolicy) (bool, error) {\n\tePolicy, err := e.policyDocumentString()\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"error rendering PolicyDocument: %v\", err)\n\t}\n\n\tif a == nil && ePolicy == \"\" && e.ExternalPolicies == nil {\n\t\treturn false, nil\n\t}\n\n\treturn true, nil\n}\n\nfunc (_ *IAMRolePolicy) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMRolePolicy) error {\n\tctx := context.TODO()\n\tpolicy, err := e.policyDocumentString()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error rendering PolicyDocument: %v\", err)\n\t}\n\n\t// Handles the full lifecycle of Policy Overrides\n\tif e.Managed {","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L143-L179","documentation":"IAMRolePolicy.ShouldCreate renders the desired PolicyDocument via policyDocumentString(), which reads the fi.Resource and enforces the 10240-byte IAM inline policy limit. Any read or size-check failure is wrapped as 'error rendering PolicyDocument'. This decides whether the task needs creating.","triggerScenarios":"e.PolicyDocument's Resource cannot be read (embedded file missing, ReadBytes error), or the rendered policy exceeds 10240 bytes during the ShouldCreate lifecycle hook.","commonSituations":"Overly large IAM policies generated from many permissions; assets/files referenced by the policy missing from the model; broken custom fi.Resource implementations.","solutions":["Read the wrapped error — if it is the size error, shrink the policy under 10240 bytes or switch to managed policies via ExternalPolicies","Ensure the PolicyDocument resource is present and readable in the cluster spec","Validate policy JSON size locally before running kops update","Re-run `kops update cluster` after fixing the resource"],"exampleFix":"// before: huge inline policy\n// after: use managed policies instead\niamRolePolicy := &awstasks.IAMRolePolicy{\n  Role: role,\n  ExternalPolicies: &[]string{\"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess\"},\n  Managed: true,\n}","handlingStrategy":"validation","validationCode":"// check policy size before kops update\npolicy, _ := os.ReadFile(\"policy.json\")\nif len(policy) > 10240 {\n  log.Fatal(\"policy exceeds IAM 10240-byte inline limit; use a managed policy\")\n}\nvar v any\nif err := json.Unmarshal(policy, &v); err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n  if strings.Contains(err.Error(), \"error rendering PolicyDocument\") {\n    // shrink policy or switch to ExternalPolicies, then retry\n  }\n}","preventionTips":["Keep generated inline policies under 10240 bytes","Validate PolicyDocument resources exist and are readable","Use managed policies (ExternalPolicies) for large permission sets","Render the model (kops toolkit) to sanity-check generated policies"],"tags":["iam","policy-document","size-limit"],"backgroundTag":"policy-document-render-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}