kubernetes/kops · error

calling IAM GetRole on %s: %w

Error message

calling IAM GetRole on %s: %w

What it means

Fires in ListIAMRoles when iam.GetRole fails for a specific role with an error that is neither NoSuchEntity (skipped with a warning) nor a 403 (warned and skipped) — an unexpected API failure while fetching role details.

Source

Thrown at pkg/resources/aws/aws.go:2013

		for paginator.HasMorePages() {
			page, err := paginator.NextPage(ctx)
			if err != nil {
				return nil, fmt.Errorf("error listing IAM roles: %v", err)
			}
			for _, r := range page.Roles {
				name := aws.ToString(r.RoleName)

				getRequest := &iam.GetRoleInput{RoleName: r.RoleName}
				roleOutput, err := c.IAM().GetRole(ctx, getRequest)
				if err != nil {
					if awsup.IsIAMNoSuchEntityException(err) {
						klog.Warningf("could not find role %q. Resource may already have been deleted: %v", name, err)
						continue
					} else if awsup.AWSErrorCode(err) == "403" {
						klog.Warningf("failed to determine ownership of %q: %v", name, err)
						continue
					}
					return nil, fmt.Errorf("calling IAM GetRole on %s: %w", name, err)
				}
				for _, tag := range roleOutput.Role.Tags {
					if fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == "owned" {
						resourceTracker := &resources.Resource{
							Name:    name,
							ID:      name,
							Type:    "iam-role",
							Deleter: DeleteIAMRole,
						}
						resourceTrackers = append(resourceTrackers, resourceTracker)
					}
				}
			}
		}
	}

	return resourceTrackers, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check iam:GetRole permission for the role ARN
2. Retry; transient throttling or API errors can be resolved by re-running
3. Inspect the wrapped error code to see why neither the NoSuchEntity nor 403 path applied

When it happens

Trigger: Thrown at pkg/resources/aws/aws.go:2013 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a81a68abec6a8d3e. Report an issue: GitHub.