{"record":{"id":"d67d07bb0fe72bd9","repo":"kubernetes/kops","slug":"error-rendering-rolepolicydocument-v","errorCode":null,"errorMessage":"error rendering RolePolicyDocument: %v","messagePattern":"error rendering RolePolicyDocument: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrole.go","lineNumber":238,"sourceCode":"\t\t\t}\n\t\t\t_, err := t.Cloud.IAM().DetachRolePolicy(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error detaching IAM role policy %q: %v\", *policy.PolicyArn, err)\n\t\t\t}\n\t\t}\n\n\t\trequest := &iam.DeleteRoleInput{\n\t\t\tRoleName: a.Name,\n\t\t}\n\t\tif _, err := t.Cloud.IAM().DeleteRole(ctx, request); err != nil {\n\t\t\treturn fmt.Errorf(\"error deleting IAM role: %v\", err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tpolicy, err := fi.ResourceAsString(e.RolePolicyDocument)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error rendering RolePolicyDocument: %v\", err)\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating IAMRole with Name:%q\", *e.Name)\n\n\t\trequest := &iam.CreateRoleInput{}\n\t\trequest.AssumeRolePolicyDocument = aws.String(policy)\n\t\trequest.RoleName = e.Name\n\t\trequest.Tags = mapToIAMTags(e.Tags)\n\n\t\tif e.PermissionsBoundary != nil {\n\t\t\trequest.PermissionsBoundary = e.PermissionsBoundary\n\t\t}\n\n\t\tresponse, err := t.Cloud.IAM().CreateRole(ctx, request)\n\t\tif err != nil {\n\t\t\tklog.V(2).Infof(\"IAMRole policy: %s\", policy)\n\t\t\treturn fmt.Errorf(\"error creating IAMRole: %v\", err)","sourceCodeStart":220,"sourceCodeEnd":256,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrole.go#L220-L256","documentation":"RenderAWS renders the desired role's trust/assume-role policy document via fi.ResourceAsString before comparing or sending it to AWS. If the resource is not plain bytes — e.g. it is a fi.TemplateResource whose Go template execution fails — the error is wrapped as 'error rendering RolePolicyDocument: %v'.","triggerScenarios":"The RolePolicyDocument is a fi.TemplateResource and its template references undefined variables or functions, the template file is missing from the built binary, or the embedded template execution step fails.","commonSituations":"Custom changes that replace the policy document with a template using a typo'd variable; kOps version upgrades renaming template context fields; vendored template asset not embedded in the build.","solutions":["Read the wrapped inner error: it names the missing template key or parse failure","Fix the template variable names to match the RenderAWS context fields","Ensure the template file is embedded/packaged (verify the fi.TemplateResource path is correct)","If using a custom build, verify the asset was included in the build step"],"exampleFix":"// before: typo in template variable\n\"{{ .AssumeRolePolicyPrincipal }}\"\n\n// after: use the defined context field\n\"{{ .Principal }}\"","handlingStrategy":"validation","validationCode":"// Render the document yourself before handing it to the task\npolicyJSON, err := fi.ResourceAsString(rolePolicyDocument)\nif err != nil { return fmt.Errorf(\"invalid RolePolicyDocument: %w\", err) }\nvar doc map[string]interface{}\nif err := json.Unmarshal([]byte(policyJSON), &doc); err != nil {\n    return fmt.Errorf(\"RolePolicyDocument is not valid JSON: %w\", err)\n}","typeGuard":"func isRenderableResource(r fi.Resource) bool {\n    _, err := fi.ResourceAsString(r)\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Prefer fi.NewStringResource over templates for policy documents","Unit-test any TemplateResource rendering before apply","Keep the state store and kOps binary on the same version","Lint policy JSON in CI before applying cluster specs"],"tags":["aws","iam","go","template"],"backgroundTag":"policy-template-render-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}