{"record":{"id":"80c99fc1aed6fda2","repo":"kubernetes/kops","slug":"error-converting-cloudformation-policy-document-to","errorCode":null,"errorMessage":"error converting cloudformation policy document to JSON: %v","messagePattern":"error converting cloudformation policy document to JSON: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":130,"sourceCode":"\t}\n\tif p.PolicyDocument != nil {\n\t\t// The PolicyDocument is URI encoded (?)\n\t\tpolicy := *p.PolicyDocument\n\t\tpolicy, err = url.QueryUnescape(policy)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing PolicyDocument for IAMRolePolicy %q: %v\", aws.ToString(e.Name), err)\n\t\t}\n\n\t\t// Reformat the PolicyDocument by unmarshaling and re-marshaling to JSON.\n\t\t// This will make it possible to compare it when using CloudFormation.\n\t\tvar jsonData interface{}\n\t\terr = json.Unmarshal([]byte(policy), &jsonData)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing cloudformation policy document from JSON: %v\", err)\n\t\t}\n\t\tjsonBytes, err := json.MarshalIndent(jsonData, \"\", \"  \")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error converting cloudformation policy document to JSON: %v\", err)\n\t\t}\n\t\tactual.PolicyDocument = fi.NewStringResource(string(jsonBytes))\n\t}\n\n\tactual.Name = p.PolicyName\n\n\te.ID = actual.ID\n\n\t// Avoid spurious changes\n\tactual.Lifecycle = e.Lifecycle\n\n\treturn &actual, nil\n}\n\nfunc (e *IAMRolePolicy) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L112-L148","documentation":"After successfully unmarshaling the policy document, Find re-marshals it with json.MarshalIndent for stable comparison. MarshalIndent on an interface{} decoded from JSON can only realistically fail on unsupported-value panics/errors or resource exhaustion; kops wraps any such failure with this message.","triggerScenarios":"json.MarshalIndent fails while re-serializing the decoded policy document during IAMRolePolicy.Find.","commonSituations":"Extremely large policy documents causing allocation failure; exotic environments where marshal fails after unmarshal (e.g. memory pressure); practically rare in normal operation.","solutions":["Retry the operation — this is rarely a persistent failure","Reduce the policy document size (IAM limit is 10240 bytes for inline policies)","Check machine memory if repeatedly failing on huge policies"],"exampleFix":"// shrink the policy to stay well under the 10 KB inline limit\n// before: one policy with hundreds of statements\n// after: split into multiple policies or use a managed policy ARN via ExternalPolicies","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := kopsUpdate()\nif err != nil && strings.Contains(err.Error(), \"converting cloudformation policy document\") {\n  // transient; retry after backoff\n  time.Sleep(time.Second); retry(kopsUpdate)\n}","preventionTips":["Keep inline policies small (well under the 10240-byte limit)","Prefer managed policies for large permission sets","Ensure sufficient memory on the machine running kops"],"tags":["iam","json","policy-document"],"backgroundTag":"policy-document-parse-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}