{"record":{"id":"ed37149a4c640911","repo":"kubernetes/kops","slug":"error-listing-policies-for-role-w","errorCode":null,"errorMessage":"error listing policies for role: %w","messagePattern":"error listing policies for role: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":74,"sourceCode":"\tctx := c.Context()\n\tvar actual IAMRolePolicy\n\n\tcloud := awsup.GetCloud(c)\n\n\t// Handle policy overrides\n\tif e.ExternalPolicies != nil {\n\t\trequest := &iam.ListAttachedRolePoliciesInput{\n\t\t\tRoleName: e.Role.Name,\n\t\t}\n\n\t\tresponse, err := cloud.IAM().ListAttachedRolePolicies(ctx, request)\n\t\tif err != nil {\n\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\tklog.V(2).Infof(\"Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted\")\n\t\t\t\treturn nil, nil\n\t\t\t}\n\n\t\t\treturn nil, fmt.Errorf(\"error listing policies for role: %w\", err)\n\t\t}\n\n\t\tvar policies []string\n\t\tif response != nil && len(response.AttachedPolicies) > 0 {\n\t\t\tfor _, policy := range response.AttachedPolicies {\n\t\t\t\tpolicies = append(policies, aws.ToString(policy.PolicyArn))\n\t\t\t}\n\t\t}\n\t\tsort.Strings(policies)\n\n\t\tactual.ID = e.ID\n\t\tactual.Name = e.Name\n\t\tactual.Lifecycle = e.Lifecycle\n\t\tactual.Role = e.Role\n\t\tactual.Managed = true\n\t\tactual.ExternalPolicies = &policies\n\n\t\treturn &actual, nil","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L56-L92","documentation":"During IAMRolePolicy.Find, kops calls ListAttachedRolePolicies to discover the managed external policies attached to the role. If the AWS IAM API returns an error that is not NoSuchEntity, it is wrapped with this message. It means the IAM lookup itself failed, so the actual state of attached policies is unknown.","triggerScenarios":"ListAttachedRolePolicies fails with network/throttling/auth errors (e.g. AccessDenied, ThrottlingException, request timeout) while finding an IAMRolePolicy that has ExternalPolicies set.","commonSituations":"AWS credentials lacking iam:ListAttachedRolePolicies permission; IAM rate limiting on a busy account; transient network failures or VPC endpoint issues; role deleted concurrently by another controller.","solutions":["Read the wrapped AWS error to identify the specific API failure (AccessDenied, Throttling, timeout)","Verify the calling credentials have iam:ListAttachedRolePolicies on the role","Retry the kops update after transient throttling/network errors (or reduce concurrent IAM calls)","Check that the role still exists and is not being deleted concurrently"],"exampleFix":"// IAM policy allowing the lookup\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\"iam:ListAttachedRolePolicies\", \"iam:GetRolePolicy\"],\n  \"Resource\": \"*\"\n}","handlingStrategy":"retry","validationCode":"// pre-check IAM permissions\n_, err := iamClient.ListAttachedRolePolicies(ctx, &iam.ListAttachedRolePoliciesInput{RoleName: aws.String(roleName)})\nif err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":"err := kopsUpdate()\nvar re *types.ThrottlingException\nif errors.As(err, &re) || isTransient(err) {\n  time.Sleep(backoff); retry(kopsUpdate)\n}","preventionTips":["Grant iam:ListAttachedRolePolicies to kops credentials","Back off on IAM throttling; avoid many concurrent kops runs","Confirm the role exists before reconciling policies","Use STS sessions with the correct account/region"],"tags":["aws","iam","api-error"],"backgroundTag":"aws-iam-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}