kubernetes/kops · error

error building IAM policy: %w

Error message

error building IAM policy: %w

What it means

Serializing an assembled IAM policy document to JSON failed while building additional role policies; a json.Marshal failure over the parsed statements, normally indicating an unmarshalable field within a statement.

Source

Thrown at pkg/model/awsmodel/iam.go:375

				additionalPolicyName := "additional." + iamName

				t := &awstasks.IAMRolePolicy{
					Name:      new(additionalPolicyName),
					Lifecycle: b.Lifecycle,

					Role: iamRole,
				}

				if additionalPolicy != "" {
					p, err := b.buildPolicy(additionalPolicy)
					if err != nil {
						return fmt.Errorf("additionalPolicy %q is invalid: %v", roleKey, err)
					}

					policy, err := p.AsJSON()
					if err != nil {
						return fmt.Errorf("error building IAM policy: %w", err)
					}

					t.PolicyDocument = fi.NewStringResource(policy)
				} else {
					t.PolicyDocument = fi.NewStringResource("")
				}

				c.AddTask(t)
			}
		}
	}

	return nil
}

func (b *IAMModelBuilder) buildPolicy(policyString string) (*iam.Policy, error) {
	p := &iam.Policy{
		Version: iam.PolicyDefaultVersion,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the additionalPolicy content in the instance group for unusual constructs
2. Simplify the additional policy JSON and retry
3. Report as a bug if the policy is valid AWS JSON

When it happens

Trigger: Thrown at pkg/model/awsmodel/iam.go:375 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/148b71aca0984ceb. Report an issue: GitHub.