{"record":{"id":"defa93734eda8bbd","repo":"kubernetes/kops","slug":"error-listing-iam-oidc-providers-v","errorCode":null,"errorMessage":"error listing IAM OIDC Providers: %v","messagePattern":"error listing IAM OIDC Providers: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":2136,"sourceCode":"\t\tresourceTracker.Blocks = append(resourceTracker.Blocks, \"iam-role:\"+name)\n\n\t\tresourceTrackers = append(resourceTrackers, resourceTracker)\n\t}\n\n\treturn resourceTrackers, nil\n}\n\nfunc ListIAMOIDCProviders(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\ttags := c.Tags()\n\n\tvar providers []*string\n\t{\n\t\trequest := &iam.ListOpenIDConnectProvidersInput{}\n\t\tresponse, err := c.IAM().ListOpenIDConnectProviders(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing IAM OIDC Providers: %v\", err)\n\t\t}\n\t\tfor _, provider := range response.OpenIDConnectProviderList {\n\t\t\tarn := provider.Arn\n\t\t\tdescReq := &iam.GetOpenIDConnectProviderInput{\n\t\t\t\tOpenIDConnectProviderArn: arn,\n\t\t\t}\n\t\t\tresp, err := c.IAM().GetOpenIDConnectProvider(ctx, descReq)\n\t\t\tif err != nil {\n\t\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\t\tklog.Warningf(\"could not find IAM OIDC Provider %q. Resource may already have been deleted: %v\", aws.ToString(arn), err)\n\t\t\t\t\tcontinue\n\t\t\t\t} else if awsup.AWSErrorCode(err) == \"403\" {\n\t\t\t\t\tklog.Warningf(\"failed to determine ownership of %q: %v\", aws.ToString(arn), err)\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\treturn nil, fmt.Errorf(\"error getting IAM OIDC Provider %q: %w\", aws.ToString(arn), err)\n\t\t\t}\n\t\t\tif !matchesIAMTags(tags, resp.Tags) {","sourceCodeStart":2118,"sourceCodeEnd":2154,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L2118-L2154","documentation":"kOps wraps the AWS SDK error from iam.ListOpenIDConnectProviders while enumerating OIDC providers (e.g. for IRSA) to find cluster-owned ones. The whole listing operation fails if this IAM call fails. The cause is always the wrapped err.","triggerScenarios":"ListOpenIDConnectProviders fails: throttling, missing iam:ListOpenIDConnectProviders permission (AccessDenied), invalid or expired credentials, network errors.","commonSituations":"Restricted IAM policies used for least-privilege cluster deletion that omit OIDC listing; shared accounts hitting IAM request throttling; expired CI credentials.","solutions":["Run `aws iam list-open-id-connect-providers` with the same credentials to see the raw error","Add iam:ListOpenIDConnectProviders to the caller's policy if AccessDenied","Back off and retry if throttled","Refresh credentials / fix region config"],"exampleFix":"// before\n{\"Effect\":\"Allow\",\"Action\":[\"iam:DeleteOpenIDConnectProvider\"],\"Resource\":\"*\"}\n// after: include list permission\n{\"Effect\":\"Allow\",\"Action\":[\"iam:ListOpenIDConnectProviders\",\"iam:GetOpenIDConnectProvider\",\"iam:DeleteOpenIDConnectProvider\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// preflight: confirm credentials and IAM read access\n_, err := iamClient.ListOpenIDConnectProviders(ctx, &iam.ListOpenIDConnectProvidersInput{MaxItems: aws.Int32(1)})\nif err != nil { return fmt.Errorf(\"IAM OIDC preflight failed: %w\", err) }","typeGuard":"func isAccessDenied(err error) bool {\n  var ae smithy.APIError\n  return errors.As(err, &ae) && strings.Contains(ae.ErrorCode(), \"AccessDenied\")\n}","tryCatchPattern":"arns, err := ListClusterOIDCProviders(ctx, cloud, clusterName)\nvar ae smithy.APIError\nif errors.As(err, &ae) {\n  switch {\n  case strings.Contains(ae.ErrorCode(), \"AccessDenied\"): klog.Warningf(\"no IAM OIDC list permission: %v\", err)\n  default: return err\n  }\n}","preventionTips":["Include iam:ListOpenIDConnectProviders and iam:GetOpenIDConnectProvider in deletion policies","Validate `aws sts get-caller-identity` before long jobs","Throttle concurrent IAM API usage","Pin the AWS SDK region config to the cluster region"],"tags":["aws","iam","oidc"],"backgroundTag":"aws-iam-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}