kubernetes/kops · error

calling IAM GetRole on %s: %w

Error message

calling IAM GetRole on %s: %w

What it means

IAM GetRole on a specific role name failed during deletion discovery; the role may be unreadable due to permissions or was concurrently deleted, and unlike the listing call this lookup is not paginated or retried.

Source

Thrown at pkg/model/awsmodel/iam.go:484

func (b *IAMModelBuilder) FindDeletions(context *fi.CloudupModelBuilderContext, cloud fi.Cloud) error {
	ctx := context.Context()
	iamapi := cloud.(awsup.AWSCloud).IAM()
	ownershipTag := "kubernetes.io/cluster/" + b.Cluster.ObjectMeta.Name
	request := &awsiam.ListRolesInput{}
	paginator := awsiam.NewListRolesPaginator(iamapi, request)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return fmt.Errorf("listing IAM roles: %w", err)
		}
		for _, role := range page.Roles {
			if !strings.HasSuffix(fi.ValueOf(role.RoleName), "."+b.Cluster.ObjectMeta.Name) {
				continue
			}
			getRequest := &awsiam.GetRoleInput{RoleName: role.RoleName}
			roleOutput, err := iamapi.GetRole(ctx, getRequest)
			if err != nil {
				return fmt.Errorf("calling IAM GetRole on %s: %w", fi.ValueOf(role.RoleName), err)
			}
			for _, tag := range roleOutput.Role.Tags {
				if fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == "owned" {
					if _, ok := context.Tasks["IAMRole/"+fi.ValueOf(role.RoleName)]; !ok {
						context.AddTask(&awstasks.IAMRole{
							ID:        role.RoleId,
							Name:      role.RoleName,
							Lifecycle: b.Lifecycle,
						})
					}
				}
			}
		}
	}
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check iam:GetRole permissions for the identity in use
2. Verify the role still exists in the AWS console
3. Re-run the operation once IAM state is consistent

When it happens

Trigger: Thrown at pkg/model/awsmodel/iam.go:484 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b13a80dbc61e1297. Report an issue: GitHub.