{"record":{"id":"a755ac507a8dec55","repo":"kubernetes/kops","slug":"failed-to-get-value-for-ssm-parameter-w","errorCode":null,"errorMessage":"failed to get value for SSM parameter: %w","messagePattern":"failed to get value for SSM parameter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":1704,"sourceCode":"\n// ResolveImage finds an AMI image based on the given name.\n// The name can be one of:\n// `ami-...` in which case it is presumed to be an id\n// owner/name in which case we find the image with the specified name, owned by owner\n// name in which case we find the image with the specified name, with the current owner\nfunc (c *awsCloudImplementation) ResolveImage(name string) (*ec2types.Image, error) {\n\treturn resolveImage(context.TODO(), c.ssm, c.ec2, name)\n}\n\nfunc resolveSSMParameter(ctx context.Context, ssmClient awsinterfaces.SSMAPI, name string) (string, error) {\n\tklog.V(2).Infof(\"Resolving SSM parameter %q\", name)\n\trequest := &ssm.GetParameterInput{\n\t\tName: aws.String(name),\n\t}\n\n\tresponse, err := ssmClient.GetParameter(ctx, request)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get value for SSM parameter: %w\", err)\n\t}\n\n\treturn aws.ToString(response.Parameter.Value), nil\n}\n\nfunc resolveImage(ctx context.Context, ssmClient awsinterfaces.SSMAPI, ec2Client awsinterfaces.EC2API, name string) (*ec2types.Image, error) {\n\t// TODO: Cache this result during a single execution (we get called multiple times)\n\tklog.V(2).Infof(\"Calling DescribeImages to resolve name %q\", name)\n\trequest := &ec2.DescribeImagesInput{}\n\n\tif strings.HasPrefix(name, \"ami-\") {\n\t\t// ami-xxxxxxxx\n\t\trequest.ImageIds = []string{name}\n\t} else if strings.HasPrefix(name, \"ssm:\") {\n\t\tparameter := strings.TrimPrefix(name, \"ssm:\")\n\n\t\timage, err := resolveSSMParameter(ctx, ssmClient, parameter)\n\t\tif err != nil {","sourceCodeStart":1686,"sourceCodeEnd":1722,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L1686-L1722","documentation":"Returned by resolveSSMParameterValue (aws_cloud.go:1704) when ssm.GetParameter fails for the given parameter name. kops uses SSM public parameters to resolve AMI IDs for official images; any SSM-side failure is wrapped here with the AWS error attached.","triggerScenarios":"ssmClient.GetParameter is called with Name=<parameter> and AWS returns an error: parameter does not exist, wrong region (SSM parameters are regional), missing ssm:GetParameter IAM permission, or throttling.","commonSituations":"Kops version references an SSM parameter path that changed; cluster region differs from where the parameter is published; IAM policy lacks ssm:GetParameter on the parameter ARN; transient SSM throttling.","solutions":["Read the wrapped AWS error: ParameterNotFound means check the parameter path and region; AccessDenied means fix IAM","Verify the parameter exists: `aws ssm get-parameter --name <name> --region <region>`","Grant ssm:GetParameter on the parameter ARN to the caller's IAM identity","Upgrade/downgrade kops if the SSM parameter path changed between versions"],"exampleFix":"// before\naws ssm get-parameter --name /aws/service/ami-windows-latest/...\n# ParameterNotFound in us-west-1\n// after\naws ssm get-parameter --name /aws/service/eks/optimized-ami/1.29/amazon-linux-2/recommended --region us-east-1","handlingStrategy":"try-catch","validationCode":"// Check SSM parameter readability before relying on it\n_, err := ssmClient.GetParameter(ctx, &ssm.GetParameterInput{Name: aws.String(paramName)})\nif err != nil { return fmt.Errorf(\"SSM parameter %s unavailable: %w\", paramName, err) }","typeGuard":null,"tryCatchPattern":"val, err := resolveSSMParameterValue(ctx, ssmClient, name)\nif err != nil {\n\tvar nf *ssmtypes.ParameterNotFound\n\tif errors.As(err, &nf) { /* fall back to a hardcoded AMI ID or alternate region */ }\n\treturn err\n}","preventionTips":["Verify the SSM parameter path exists in the cluster's region (`aws ssm get-parameter`)","Grant ssm:GetParameter on the parameter ARN to the calling identity","Keep kops up to date so SSM public parameter paths match current AWS published keys"],"tags":["aws","ssm","iam","ami"],"backgroundTag":"ssm-parameter-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}