kubernetes/kops · error

error creating IAM policy for bucket gs://%s: %w

Error message

error creating IAM policy for bucket gs://%s: %w

What it means

StorageBucketIAM.RenderGCE wraps a failure while reading the bucket's current IAM policy before patching it. The misleading "creating IAM policy" wording refers to fetching the policy so the desired member binding can be added; the underlying error is in the wrapped %w.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/storagebucketiam.go:115

	}
	if fi.ValueOf(e.Role) == "" {
		return fi.RequiredField("Role")
	}
	return nil
}

func (_ *StorageBucketIAM) RenderGCE(t *gce.GCEAPITarget, a, e, changes *StorageBucketIAM) error {
	ctx := context.TODO()

	bucket := fi.ValueOf(e.Bucket)
	member := "serviceAccount:" + fi.ValueOf(e.MemberServiceAccount.Email)
	role := fi.ValueOf(e.Role)

	klog.V(2).Infof("Creating GCS bucket IAM for gs://%s for %s as %s", bucket, member, role)

	policy, err := t.Cloud.Storage().Bucket(bucket).IAM().V3().Policy(ctx)
	if err != nil {
		return fmt.Errorf("error creating IAM policy for bucket gs://%s: %w", bucket, err)
	}

	changed := patchPolicy(policy, member, role)

	if !changed {
		klog.Warningf("did not need to change policy (concurrent change?)")
		return nil
	}

	if err := t.Cloud.Storage().Bucket(bucket).IAM().V3().SetPolicy(ctx, policy); err != nil {
		return fmt.Errorf("error updating GCS bucket IAM for gs://%s: %v", bucket, err)
	}

	return nil
}

// terraformStorageBucketIAM is the model for a terraform google_storage_bucket_iam_member rule
type terraformStorageBucketIAM struct {

View on GitHub (pinned to 4c8573c808)

Solutions

  1. Read the wrapped error: 403 => grant roles/storage.admin (or storage.buckets.getIamPolicy) to the kOps service account; 404 => recreate/fix the bucket.
  2. Ensure the bucket task runs before the StorageBucketIAM task so the bucket exists.
  3. Check org policy constraints (iam.allowedPolicyMemberDomains) if member binding is the real blocker.
  4. Retry on transient errors; confirm credentials with `gcloud storage buckets get-iam-policy`.
Defensive patterns

Strategy: retry

Validate before calling

if _, err := exec.Command("gcloud", "storage", "buckets", "describe", "gs://"+bucket).Output(); err != nil {
    return fmt.Errorf("bucket gs://%s must exist before IAM task: %w", bucket, err)
}
if !hasPerm("storage.buckets.getIamPolicy") { return fmt.Errorf("missing storage.buckets.getIamPolicy") }

Try / catch

if err := kopsUpdate(); err != nil {
    if strings.Contains(err.Error(), "error creating IAM policy for bucket") {
        if strings.Contains(err.Error(), "404") {
            log.Print("bucket deleted; re-run to recreate bucket first")
        } else if isTransient(err) {
            retryWithBackoff()
        }
    }
    return err
}

Prevention

When it happens

Trigger: t.Cloud.Storage().Bucket(bucket).IAM().V3().Policy(ctx) fails during RenderGCE when kOps is about to add the serviceAccount member to the bucket policy.

Common situations: Missing storage.buckets.getIamPolicy permission for the bucket; bucket deleted between Find and apply; bucket in another project without cross-project grants; org policy blocking IAM reads via domain-restricted sharing constraints; transient GCP 5xx.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f3d5d46c3798b63f. Report an issue: GitHub.