{"record":{"id":"e3e3f329d180ddf1","repo":"kubernetes/kops","slug":"error-getting-role-v","errorCode":null,"errorMessage":"error getting role: %v","messagePattern":"error getting role: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrole.go","lineNumber":75,"sourceCode":"\nvar _ fi.CompareWithID = (*IAMRole)(nil)\n\nfunc (e *IAMRole) CompareWithID() *string {\n\treturn e.ID\n}\n\nfunc (e *IAMRole) Find(c *fi.CloudupContext) (*IAMRole, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\trequest := &iam.GetRoleInput{RoleName: e.Name}\n\n\tresponse, err := cloud.IAM().GetRole(ctx, request)\n\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\treturn nil, nil\n\t}\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting role: %v\", err)\n\t}\n\n\tr := response.Role\n\tactual := &IAMRole{}\n\tactual.ID = r.RoleId\n\tactual.Name = r.RoleName\n\tif r.PermissionsBoundary != nil {\n\t\tactual.PermissionsBoundary = r.PermissionsBoundary.PermissionsBoundaryArn\n\t}\n\tif r.AssumeRolePolicyDocument != nil {\n\t\t// The AssumeRolePolicyDocument is URI encoded (?)\n\t\tactualPolicy := *r.AssumeRolePolicyDocument\n\t\tactualPolicy, err = url.QueryUnescape(actualPolicy)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing AssumeRolePolicyDocument for IAMRole %s: %v\", *e.Name, err)\n\t\t}\n\n\t\t// The RolePolicyDocument is reformatted by AWS","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrole.go#L57-L93","documentation":"Find() calls IAM GetRole to snapshot the actual state of an IAMRole task. Any error other than NoSuchEntityException (which means the role is absent and treated as nil) is wrapped as 'error getting role'. This means AWS refused or failed to describe the role, not that it is missing.","triggerScenarios":"GetRole returns AccessDenied, throttling (TooManyRequestsException), invalid role name, or a transport/network failure that is not the NoSuchEntity sentinel.","commonSituations":"kOps controller IAM policy lacks iam:GetRole; large fleets hitting IAM API rate limits; role name with characters invalid for GetRole; transient AWS outage.","solutions":["Add iam:GetRole (and iam:ListRolePolicies, iam:ListAttachedRolePolicies) to the caller's IAM policy","Retry the reconcile if the cause is throttling; consider reducing reconcile concurrency","Verify the role name passed to GetRole is the exact IAM role name (no path prefix issues)","Check AWS health/status if errors are widespread"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check with a lister instead of assuming GetRole succeeds\nroles, err := iamClient.ListRoles(ctx, &iam.ListRolesInput{})\n// then match RoleName before calling GetRole","typeGuard":null,"tryCatchPattern":"resp, err := cloud.IAM().GetRole(ctx, request)\nif err != nil {\n    if awsup.IsIAMNoSuchEntityException(err) { return nil, nil }\n    var tme *types.ThrottlingException\n    if errors.As(err, &tme) { /* retry with backoff */ }\n    return nil, fmt.Errorf(\"error getting role: %w\", err)\n}","preventionTips":["Ensure iam:GetRole is granted to the reconciling identity","Serialize reconciliation of many roles to avoid IAM throttling","Treat NoSuchEntity as 'role absent' rather than an error","Log the role name alongside the wrapped error for diagnosis"],"tags":["aws","iam","api-error"],"backgroundTag":"aws-iam-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}