{"record":{"id":"aff10ed85f0af206","repo":"kubernetes/kops","slug":"error-untagging-iamoidcprovider-v","errorCode":null,"errorMessage":"error untagging IAMOIDCProvider: %v","messagePattern":"error untagging IAMOIDCProvider: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go","lineNumber":166,"sourceCode":"\n\t\t\t_, err := t.Cloud.IAM().UpdateOpenIDConnectProviderThumbprint(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error updating IAMOIDCProvider Thumbprints: %v\", err)\n\t\t\t}\n\t\t}\n\t\tif changes.Tags != nil {\n\t\t\tif len(a.Tags) > 0 {\n\t\t\t\texistingTagKeys := make([]string, 0)\n\t\t\t\tfor k := range a.Tags {\n\t\t\t\t\texistingTagKeys = append(existingTagKeys, k)\n\t\t\t\t}\n\t\t\t\tuntagRequest := &iam.UntagOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tTagKeys:                  existingTagKeys,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().UntagOpenIDConnectProvider(ctx, untagRequest)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error untagging IAMOIDCProvider: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif len(e.Tags) > 0 {\n\t\t\t\ttagRequest := &iam.TagOpenIDConnectProviderInput{\n\t\t\t\t\tOpenIDConnectProviderArn: a.arn,\n\t\t\t\t\tTags:                     mapToIAMTags(e.Tags),\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().TagOpenIDConnectProvider(ctx, tagRequest)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error tagging IAMOIDCProvider: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif changes.ClientIDs != nil {\n\t\t\tactual := sets.NewString()\n\t\t\tfor _, aud := range a.ClientIDs {\n\t\t\t\tactual.Insert(aud)\n\t\t\t}","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamoidcprovider.go#L148-L184","documentation":"Returned by IAMOIDCProvider.RenderAWS when UntagOpenIDConnectProvider fails while removing stale tags from the OIDC provider during a tag diff. kOps first untags removed keys, then applies new tags; this wrapper signals the untag half failed.","triggerScenarios":"UntagOpenIDConnectProvider fails: missing iam:UntagOpenIDConnectProvider permission, provider deleted concurrently, or throttling.","commonSituations":"Tightened IAM policies missing the relatively new untag permission; tag hygiene automation (e.g. tag policies) conflicting with kOps-managed tags; concurrent applies.","solutions":["Add iam:UntagOpenIDConnectProvider (and iam:TagOpenIDConnectProvider, iam:ListOpenIDConnectProviderTags) to the kOps policy.","Re-run kops apply after transient failures.","Ensure no other automation concurrently mutates tags on the same provider.","Check tag key constraints (valid characters, length) before removing."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check current tags so the untag set only contains keys actually present\ntagsOut, err := iamClient.ListOpenIDConnectProviderTagsWithContext(ctx, &iam.ListOpenIDConnectProviderTagsInput{OpenIDConnectProviderArn: arn})\nif err != nil { return err }","typeGuard":"func isAccessDenied(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == \"AccessDeniedException\" }","tryCatchPattern":"_, err := iamClient.UntagOpenIDConnectProviderWithContext(ctx, untagReq)\nif err != nil {\n    if isAccessDenied(err) { return fmt.Errorf(\"missing iam:UntagOpenIDConnectProvider: %w\", err) }\n    return fmt.Errorf(\"error untagging IAMOIDCProvider: %w\", err)\n}","preventionTips":["Add iam:UntagOpenIDConnectProvider to the kOps policy (newer action, often missing from old templates)","Avoid external tag-mutation automation on kOps-managed providers","Diff existing tags before untagging to keep requests minimal","Retry transient failures — untagging is idempotent"],"tags":["aws","iam","oidc","tagging","kops"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}