{"record":{"id":"dab1961c66796626","repo":"kubernetes/kops","slug":"error-parsing-iam-statements-v","errorCode":null,"errorMessage":"error parsing IAM statements: %v","messagePattern":"error parsing IAM statements: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/types.go","lineNumber":35,"sourceCode":"package iam\n\nimport (\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"strings\"\n\n\t\"k8s.io/kops/pkg/apis/kops\"\n\t\"k8s.io/kops/pkg/truncate\"\n)\n\n// MaxLengthIAMRoleName defines the max length of an IAMRole name\nconst MaxLengthIAMRoleName = 64\n\n// ParseStatements parses JSON into a list of Statements\nfunc ParseStatements(policy string) ([]*Statement, error) {\n\tstatements := make([]*Statement, 0)\n\tif err := json.Unmarshal([]byte(policy), &statements); err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing IAM statements: %v\", err)\n\t}\n\treturn statements, nil\n}\n\ntype IAMModelContext struct {\n\t// AWSAccountID holds the 12 digit AWS account ID, when running on AWS\n\tAWSAccountID string\n\t// AWSPartition defines the partition of the AWS account, typically \"aws\", \"aws-cn\", or \"aws-us-gov\"\n\tAWSPartition string\n\n\t// Cluster holds the cluster we are working with.\n\tCluster *kops.Cluster\n}\n\n// IAMNameForServiceAccountRole determines the name of the IAM Role and Instance Profile to use for the service-account role\nfunc (b *IAMModelContext) IAMNameForServiceAccountRole(role Subject) (string, error) {\n\tserviceAccount, ok := role.ServiceAccount()\n\tif !ok {","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/types.go#L17-L53","documentation":"ParseStatements failed to unmarshal a user-supplied IAM policy string as a JSON array of Statement objects; the additionalPolicy JSON is malformed, or it is a whole-document object rather than an array of statements.","triggerScenarios":"Thrown at pkg/model/iam/types.go:35 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Validate the additionalPolicy JSON — it must be an array of Statement objects","Wrap the statements in [ ... ] if a bare object was supplied","Run the policy through a JSON linter before applying"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}