{"record":{"id":"fac8c025b83721a4","repo":"kubernetes/kops","slug":"error-inline-policy-w","errorCode":null,"errorMessage":"error inline policy: %w","messagePattern":"error inline policy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/iam.go","lineNumber":140,"sourceCode":"\t\t\treturn err\n\t\t}\n\n\t\tiamName := b.IAMName(igRole)\n\t\tif err := b.buildIAMTasks(role, iamName, c, false); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tiamSpec := b.Cluster.Spec.IAM\n\tif iamSpec != nil {\n\t\tfor _, sa := range iamSpec.ServiceAccountExternalPermissions {\n\t\t\tvar p *iam.Policy\n\t\t\taws := sa.AWS\n\t\t\tif aws.InlinePolicy != \"\" {\n\t\t\t\tbp, err := b.buildPolicy(aws.InlinePolicy)\n\t\t\t\tp = bp\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error inline policy: %w\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tserviceAccount := &iam.GenericServiceAccount{\n\t\t\t\tNamespacedName: types.NamespacedName{\n\t\t\t\t\tName:      sa.Name,\n\t\t\t\t\tNamespace: sa.Namespace,\n\t\t\t\t},\n\t\t\t\tPolicy: p,\n\t\t\t}\n\t\t\tiamRole, err := b.BuildServiceAccountRoleTasks(serviceAccount, c)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error building service account role tasks: %w\", err)\n\t\t\t}\n\t\t\tif len(aws.PolicyARNs) > 0 {\n\t\t\t\tname := \"external-\" + fi.ValueOf(iamRole.Name)\n\t\t\t\texternalPolicies := aws.PolicyARNs\n\t\t\t\tc.AddTask(&awstasks.IAMRolePolicy{\n\t\t\t\t\tName:             new(name),","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/iam.go#L122-L158","documentation":"When building IAM for ServiceAccountExternalPermissions entries, an inline IAM policy JSON supplied via spec.iam.serviceAccountExternalPermissions[].aws.inlinePolicy is parsed by buildPolicy (iam.ParseStatements). If the string is not valid IAM policy JSON (bad syntax, wrong types, empty statement), the parse error is wrapped as \"error inline policy\".","triggerScenarios":"`kops update cluster` when a ServiceAccountExternalPermissions entry has aws.inlinePolicy set to invalid JSON, e.g. YAML-quoted template that never got rendered, trailing commas, or a Statement that is an object instead of an array.","commonSituations":"Hand-writing IAM policy JSON in the cluster spec; templating the policy with envsubst/Helm and leaving unexpanded placeholders; copy-pasting policies that use comments or single quotes.","solutions":["Validate the inlinePolicy string as JSON with `echo '<policy>' | jq .` and fix syntax errors.","Ensure Statement is an array and each statement has Effect/Action/Resource of the correct types.","If templating, render the template and check for unexpanded placeholders before applying."],"exampleFix":"// before\naws:\n  inlinePolicy: '{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"*\"}}'\n// after\naws:\n  inlinePolicy: '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"*\"}]}'","handlingStrategy":"validation","validationCode":"if inlinePolicy != \"\" {\n\tvar doc map[string]interface{}\n\tif err := json.Unmarshal([]byte(inlinePolicy), &doc); err != nil {\n\t\treturn fmt.Errorf(\"inlinePolicy is not valid JSON: %w\", err)\n\t}\n\tif _, ok := doc[\"Statement\"]; !ok {\n\t\treturn fmt.Errorf(\"inlinePolicy missing Statement\")\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := runKopsUpdate(); err != nil {\n\tvar parseErr *json.SyntaxError\n\tif errors.As(err, &parseErr) && strings.Contains(err.Error(), \"error inline policy\") {\n\t\t// fix inlinePolicy JSON before retrying\n\t}\n\treturn err\n}","preventionTips":["Run every inline policy through `jq` or `aws iam create-policy --dry-run` style validation before committing it.","Store policies as separate .json files and embed them via tooling instead of inline YAML strings.","Avoid unrendered template placeholders in cluster specs."],"tags":["aws","iam","json","policy-validation"],"backgroundTag":"invalid-iam-policy-json","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}