{"record":{"id":"8964e7289f2cd76c","repo":"kubernetes/kops","slug":"failed-to-generate-aws-iam-s3-access-statements","errorCode":null,"errorMessage":"failed to generate AWS IAM S3 access statements: %v","messagePattern":"failed to generate AWS IAM S3 access statements: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/iam_builder.go","lineNumber":393,"sourceCode":"\t\tclusterName:               clusterName,\n\t\tregion:                    region,\n\t\tunconditionalAction:       sets.New[string](),\n\t\tclusterTaggedAction:       sets.New[string](),\n\t\tclusterTaggedCreateAction: sets.New[string](),\n\t\tkmsDataPlaneAction:        sets.New[string](),\n\t\tpartition:                 partition,\n\t}\n\treturn p\n}\n\n// BuildAWSPolicy generates a custom policy for a Kubernetes master.\nfunc (r *NodeRoleAPIServer) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {\n\tp := NewPolicy(b.Cluster.GetName(), b.Partition, b.Region)\n\n\tb.addNodeupPermissions(p, r.warmPool)\n\n\tif err := b.AddS3Permissions(p); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate AWS IAM S3 access statements: %v\", err)\n\t}\n\n\t// The API server role may host a kms-plugin sidecar wired to the instance role\n\t// when EncryptionConfig is enabled; bypass kms:ViaService so that direct KMS\n\t// calls from kube-apiserver are not denied.\n\taddKMSIAMPolicies(p, fi.ValueOf(b.Cluster.Spec.EncryptionConfig))\n\n\tif b.Cluster.Spec.IAM != nil && b.Cluster.Spec.IAM.AllowContainerRegistry {\n\t\taddECRPermissions(p)\n\t}\n\n\tif b.Cluster.Spec.Containerd != nil && b.Cluster.Spec.Containerd.UseECRCredentialsForMirrors {\n\t\taddECRPullThroughPermissions(p)\n\t}\n\n\tif b.Cluster.Spec.Networking.AmazonVPC != nil {\n\t\taddAmazonVPCCNIPermissions(p)\n\t}","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/iam_builder.go#L375-L411","documentation":"Returned by NodeRoleAPIServer.BuildAWSPolicy when PolicyBuilder.AddS3Permissions fails while generating the S3 access statements for the kube-apiserver instance role. AddS3Permissions converts the cluster's state store paths into IAM S3 statements; any VFS parse or unsupported-backend failure there is wrapped with this message. The policy generation for the API server role is then aborted.","triggerScenarios":"Building the NodeRoleAPIServer policy (via PolicyBuilder.BuildAWSPolicy during cluster update/creation) when AddS3Permissions encounters a state store root that vfs.Context.BuildVfsPath cannot parse, or a non-S3/MemFS/FSPath backend in the default switch case.","commonSituations":"State store pointing at a backend unsupported for AWS IAM synthesis (e.g. gs://, do:// spaces URLs fed into AWS policy build); typo in the state store bucket URL; etcd backupStore with an invalid scheme; running against a cluster whose config was migrated from another cloud provider.","solutions":["Read the inner error for the exact failing path and cause.","Confirm the state store is a valid s3:// URL: `kops get cluster -o yaml` and inspect spec.configStore.base.","Correct the configStore.base (and etcd backupStore if malformed) in the cluster spec, then rerun `kops update cluster`.","If intentionally using another cloud's storage, do not build AWS IAM policies for it — use the matching provider's model."],"exampleFix":"// before\nspec:\n  configStore:\n    base: gs://my-kops-bucket/cluster.example.com\n// after\nspec:\n  configStore:\n    base: s3://my-kops-bucket/cluster.example.com","handlingStrategy":"validation","validationCode":"// Validate configStore.base is parseable and S3 before building policies\nif _, err := vfs.Context.BuildVfsPath(cluster.Spec.ConfigStore.Base); err != nil {\n    return fmt.Errorf(\"bad configStore.base %q: %w\", cluster.Spec.ConfigStore.Base, err)\n}","typeGuard":null,"tryCatchPattern":"policy, err := apiServerRole.BuildAWSPolicy(builder)\nif err != nil {\n    return nil, fmt.Errorf(\"api-server IAM policy: %w\", err)\n}","preventionTips":["Keep configStore.base and role bucket in the same valid s3:// form","Validate the full cluster spec with `kops get cluster -o yaml` before updates","Avoid cross-cloud state store values on AWS clusters"],"tags":["aws","iam","s3","kops"],"backgroundTag":"iam-s3-permissions-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}