kubernetes/kops · error

error attaching IAMRolePolicy: %v

Error message

error attaching IAMRolePolicy: %v

What it means

When the task is Managed (ExternalPolicies lifecycle), RenderAWS attaches each desired policy ARN to the role with AttachRolePolicy. Any non-nil error from that API call is wrapped as 'error attaching IAMRolePolicy'. The desired state is not converged.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:196

	// Handles the full lifecycle of Policy Overrides
	if e.Managed {
		// Attach policies that are not already attached
	AttachPolicies:
		for _, policy := range *e.ExternalPolicies {
			for _, cloudPolicy := range *a.ExternalPolicies {
				if cloudPolicy == policy {
					continue AttachPolicies
				}
			}

			request := &iam.AttachRolePolicyInput{
				RoleName:  e.Role.Name,
				PolicyArn: s(policy),
			}

			_, err = t.Cloud.IAM().AttachRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error attaching IAMRolePolicy: %v", err)
			}
		}

		// Clean up unused cloud policies
	CheckPolicies:
		for _, cloudPolicy := range *a.ExternalPolicies {
			for _, policy := range *e.ExternalPolicies {
				if policy == cloudPolicy {
					continue CheckPolicies
				}
			}

			klog.V(2).Infof("Detaching unused IAMRolePolicy %s/%s", aws.ToString(e.Role.Name), cloudPolicy)

			// Detach policy
			request := &iam.DetachRolePolicyInput{
				RoleName:  e.Role.Name,
				PolicyArn: s(cloudPolicy),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify each ARN in ExternalPolicies exists: `aws iam get-policy --policy-arn <arn>`
2. Grant iam:AttachRolePolicy (and GetPolicy) to the kops credentials
3. Fix typo'd/region/account-wrong ARNs in the cluster spec and re-run update
4. Retry if the wrapped error is throttling

Example fix

// before
ExternalPolicies: &[]string{"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccessv2"} // typo
// after
ExternalPolicies: &[]string{"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"}

// verify every ExternalPolicies ARN exists before kops update
for _, arn := range externalPolicies {
  if _, err := iamClient.GetPolicy(ctx, &iam.GetPolicyInput{PolicyArn: aws.String(arn)}); err != nil {
    log.Fatalf("policy ARN not found: %s (%v)", arn, err)
  }
}

var nfe *types.NoSuchEntityException
if err := kopsUpdate(); err != nil {
  switch {
  case errors.As(err, &nfe): // fix wrong/missing policy ARN in spec
  case isThrottling(err): // retry with backoff
  default: log.Printf("attach failed: %v", err)
  }
}

When it happens

Trigger: AttachRolePolicy returns AccessDenied, NoSuchEntity (policy ARN doesn't exist or role missing), throttling, or LimitExceeded while attaching an ExternalPolicies ARN in RenderAWS.

Common situations: Typo'd or nonexistent policy ARN in the cluster spec (often after copying ARNs across accounts/regions); credentials lacking iam:AttachRolePolicy; policy deleted from the account; IAM throttling on large clusters.

Related errors

• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• error listing hosted zones: %w
• arn %q has unrecognized type

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ea3660a1adee11bd. Report an issue: GitHub.