{"record":{"id":"c613767d1bfec385","repo":"kubernetes/kops","slug":"error-building-iam-policy-v","errorCode":null,"errorMessage":"error building IAM policy: %v","messagePattern":"error building IAM policy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/iam_builder.go","lineNumber":796,"sourceCode":"\t\thostedZoneID := fi.ValueOf(b.DNSZone.ZoneID)\n\t\tif hostedZoneID == \"\" {\n\t\t\t// ZoneID is normally populated by DNSZone.Find before this runs. In dry-run modes that\n\t\t\t// skip Find (e.g. `kops get assets`), it may still be empty; fall back to the DNS name\n\t\t\t// so the policy renders. The resulting ARN is not a valid Route53 ARN, but the policy\n\t\t\t// is not applied in that mode.\n\t\t\thostedZoneID = fi.ValueOf(b.DNSZone.DNSName)\n\t\t\tklog.V(4).Infof(\"Falling back to DNS name %q for IAM policy because ZoneID is empty\", hostedZoneID)\n\t\t}\n\t\tif hostedZoneID == \"\" {\n\t\t\t// Dependency analysis failure?\n\t\t\treturn nil, fmt.Errorf(\"DNS ZoneID not set\")\n\t\t}\n\t\tpb.HostedZoneID = hostedZoneID\n\t}\n\n\tpolicy, err := pb.BuildAWSPolicy()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building IAM policy: %v\", err)\n\t}\n\tif policy == nil {\n\t\treturn bytes.NewReader([]byte{}), nil\n\t}\n\tj, err := policy.AsJSON()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building IAM policy: %v\", err)\n\t}\n\treturn bytes.NewReader([]byte(j)), nil\n}\n\nfunc addECRPermissions(p *Policy) {\n\t// TODO - I think we can just have GetAuthorizationToken here, as we are not\n\t// TODO - making any API calls except for GetAuthorizationToken.\n\n\t// We provide ECR access on the nodes (naturally), but we also provide access on the master.\n\t// We shouldn't be running lots of pods on the master, but it is perfectly reasonable to run\n\t// a private logging pod or similar.","sourceCodeStart":778,"sourceCodeEnd":814,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/iam_builder.go#L778-L814","documentation":"PolicyResource.Open wraps any error from pb.BuildAWSPolicy() (the role-level IAM policy builder) as 'error building IAM policy'. This is the outer wrapper for the whole S3/VFS/KMS policy assembly chain described by errors 1350-1356; the inner cause carries the specifics.","triggerScenarios":"Any role policy build failure during PolicyResource.Open: NodeRoleAPIServer/Master BuildAWSPolicy returning S3 permission errors, VFS parse failures, unreadable paths, or unsupported writeable path types — all bubbled through PolicyBuilder.BuildAWSPolicy.","commonSituations":"Invalid state store or etcd backupStore URLs (see 1353-1356); cross-cloud state stores used with AWS IAM generation; corrupted cluster spec after manual edits; kOps version mismatch with the cluster spec format.","solutions":["Read the chained inner error (%v suffix) for the root cause; it will name the failing path or role.","Fix the underlying state store / backupStore / DNS configuration as indicated by that cause.","Validate the whole spec with `kops get cluster -o yaml` and `kops validate cluster` after edits.","Rerun `kops update cluster` to regenerate the IAM policies."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate store and zone inputs before Open\nif _, err := vfs.Context.BuildVfsPath(cluster.Spec.ConfigStore.Base); err != nil {\n    return fmt.Errorf(\"invalid state store: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"r, err := policyResource.Open()\nif err != nil {\n    var inner = err.Error()\n    switch {\n    case strings.Contains(inner, \"cannot parse VFS path\"):\n        // fix state store/backupStore URL\n    case strings.Contains(inner, \"not cluster readable\"):\n        // switch to s3:// storage\n    }\n    return fmt.Errorf(\"open IAM policy resource: %w\", err)\n}","preventionTips":["Always log the full wrapped error chain (use %w / errors.Unwrap)","Validate state store, backupStore and DNS zone before updates","Keep kOps and cluster spec versions in sync"],"tags":["aws","iam","kops","policy-generation"],"backgroundTag":"iam-policy-generation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}