kubernetes/kops · error

error converting cloudformation policy document to JSON: %v

Error message

error converting cloudformation policy document to JSON: %v

What it means

After successfully unmarshaling the policy document, Find re-marshals it with json.MarshalIndent for stable comparison. MarshalIndent on an interface{} decoded from JSON can only realistically fail on unsupported-value panics/errors or resource exhaustion; kops wraps any such failure with this message.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:130

	}
	if p.PolicyDocument != nil {
		// The PolicyDocument is URI encoded (?)
		policy := *p.PolicyDocument
		policy, err = url.QueryUnescape(policy)
		if err != nil {
			return nil, fmt.Errorf("error parsing PolicyDocument for IAMRolePolicy %q: %v", aws.ToString(e.Name), err)
		}

		// Reformat the PolicyDocument by unmarshaling and re-marshaling to JSON.
		// This will make it possible to compare it when using CloudFormation.
		var jsonData interface{}
		err = json.Unmarshal([]byte(policy), &jsonData)
		if err != nil {
			return nil, fmt.Errorf("error parsing cloudformation policy document from JSON: %v", err)
		}
		jsonBytes, err := json.MarshalIndent(jsonData, "", "  ")
		if err != nil {
			return nil, fmt.Errorf("error converting cloudformation policy document to JSON: %v", err)
		}
		actual.PolicyDocument = fi.NewStringResource(string(jsonBytes))
	}

	actual.Name = p.PolicyName

	e.ID = actual.ID

	// Avoid spurious changes
	actual.Lifecycle = e.Lifecycle

	return &actual, nil
}

func (e *IAMRolePolicy) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the operation — this is rarely a persistent failure
2. Reduce the policy document size (IAM limit is 10240 bytes for inline policies)
3. Check machine memory if repeatedly failing on huge policies

Example fix

// shrink the policy to stay well under the 10 KB inline limit
// before: one policy with hundreds of statements
// after: split into multiple policies or use a managed policy ARN via ExternalPolicies

err := kopsUpdate()
if err != nil && strings.Contains(err.Error(), "converting cloudformation policy document") {
  // transient; retry after backoff
  time.Sleep(time.Second); retry(kopsUpdate)
}

When it happens

Trigger: json.MarshalIndent fails while re-serializing the decoded policy document during IAMRolePolicy.Find.

Common situations: Extremely large policy documents causing allocation failure; exotic environments where marshal fails after unmarshal (e.g. memory pressure); practically rare in normal operation.

Related errors

• error parsing cloudformation policy document from JSON: %v
• error inline policy: %w
• additionalPolicy %q is invalid: %v
• error parsing expected RolePolicyDocument for IAMRole %q: %v
• error parsing actual RolePolicyDocument for IAMRole %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/80c99fc1aed6fda2. Report an issue: GitHub.