{"record":{"id":"e7968b329abb339c","repo":"kubernetes/kops","slug":"error-getting-role-v-e7968b","errorCode":null,"errorMessage":"error getting role: %v","messagePattern":"error getting role: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":105,"sourceCode":"\t\tactual.Lifecycle = e.Lifecycle\n\t\tactual.Role = e.Role\n\t\tactual.Managed = true\n\t\tactual.ExternalPolicies = &policies\n\n\t\treturn &actual, nil\n\t}\n\n\trequest := &iam.GetRolePolicyInput{\n\t\tRoleName:   e.Role.Name,\n\t\tPolicyName: e.Name,\n\t}\n\n\tresponse, err := cloud.IAM().GetRolePolicy(ctx, request)\n\tif err != nil {\n\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\treturn nil, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"error getting role: %v\", err)\n\t}\n\n\tp := response\n\tactual.Role = &IAMRole{Name: p.RoleName}\n\tif aws.ToString(e.Role.Name) == aws.ToString(p.RoleName) {\n\t\tactual.Role.ID = e.Role.ID\n\t}\n\tif p.PolicyDocument != nil {\n\t\t// The PolicyDocument is URI encoded (?)\n\t\tpolicy := *p.PolicyDocument\n\t\tpolicy, err = url.QueryUnescape(policy)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing PolicyDocument for IAMRolePolicy %q: %v\", aws.ToString(e.Name), err)\n\t\t}\n\n\t\t// Reformat the PolicyDocument by unmarshaling and re-marshaling to JSON.\n\t\t// This will make it possible to compare it when using CloudFormation.\n\t\tvar jsonData interface{}","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L87-L123","documentation":"During IAMRolePolicy.Find, kops calls GetRolePolicy to fetch the inline policy document. Non-NoSuchEntity errors from the IAM API are wrapped with this (slightly misleading) 'error getting role' message. It indicates the inline policy could not be retrieved, so the desired/actual diff cannot be computed.","triggerScenarios":"GetRolePolicy fails with errors other than NoSuchEntityException — e.g. AccessDenied, throttling, malformed request — while finding an IAMRolePolicy with an inline PolicyDocument.","commonSituations":"Credentials missing iam:GetRolePolicy; IAM API throttling during large cluster reconciliation; e.Role.Name or e.Name nil producing an invalid request; regional endpoint/connectivity issues.","solutions":["Check the wrapped AWS error code for the real cause","Grant iam:GetRolePolicy to the credentials kops uses","Ensure the task's Role.Name and policy Name are set (nil would produce an invalid request)","Retry after transient throttling/network errors"],"exampleFix":"// validate task fields before reconciliation\nif e.Role == nil || e.Role.Name == nil || e.Name == nil {\n  return fmt.Errorf(\"IAMRolePolicy requires role name and policy name\")\n}","handlingStrategy":"try-catch","validationCode":"// pre-check the inline policy is fetchable\n_, err := iamClient.GetRolePolicy(ctx, &iam.GetRolePolicyInput{RoleName: aws.String(roleName), PolicyName: aws.String(policyName)})\nif err != nil { log.Println(err) }","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n  if strings.Contains(err.Error(), \"error getting role\") {\n    log.Printf(\"IAM GetRolePolicy failed: %v\", err) // inspect underlying AWS error\n  }\n}","preventionTips":["Grant iam:GetRolePolicy to kops credentials","Ensure task Role.Name and policy Name are non-nil","Handle NoSuchEntity as already-deleted (kops does this automatically)","Watch for throttling on large clusters"],"tags":["aws","iam","api-error"],"backgroundTag":"aws-iam-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}