kubernetes/kops · error

error creating/updating IAMRolePolicy: %v

Error message

error creating/updating IAMRolePolicy: %v

What it means

RenderAWS calls the AWS IAM PutRolePolicy API to create or update the inline role policy, and the SDK returned an error. kOps wraps it verbatim so the underlying AWS error (e.g. LimitExceeded, NoSuchEntity, AccessDenied) is preserved. The apply for this task fails; retrying the apply will resume.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:282

				klog.V(2).Infof("diff: %s", d)
			}

			doPut = true
		}
	}

	if doPut {
		request := &iam.PutRolePolicyInput{}
		request.PolicyDocument = aws.String(policy)
		request.RoleName = e.Role.Name
		request.PolicyName = e.Name

		klog.V(8).Infof("PutRolePolicy RoleName=%s PolicyName=%s: %s", aws.ToString(e.Role.Name), aws.ToString(e.Name), policy)

		_, err = t.Cloud.IAM().PutRolePolicy(ctx, request)
		if err != nil {
			klog.V(2).Infof("PutRolePolicy RoleName=%s PolicyName=%s: %s", aws.ToString(e.Role.Name), aws.ToString(e.Name), policy)
			return fmt.Errorf("error creating/updating IAMRolePolicy: %v", err)
		}
	}

	// TODO: Should we use path as our tag?
	return nil // No tags in IAM
}

func (e *IAMRolePolicy) policyDocumentString() (string, error) {
	if e.PolicyDocument == nil {
		return "", nil
	}

	policy, err := fi.ResourceAsString(e.PolicyDocument)
	if err != nil {
		return "", err
	}
	policySize := len(strings.Join(strings.Fields(policy), ""))
	if policySize > 10240 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error code and fix accordingly (permissions, missing role, malformed policy).
2. Ensure the IAMRole task is applied before the IAMRolePolicy (single apply usually handles ordering; re-run kops update).
3. Check that the policy JSON is valid and under 10240 bytes before applying.
4. Retry the apply after a short wait if the error was throttling.

Example fix

// before: policy rejected by IAM
{"Version":"2012-...","Statement":[{"Effect":"allow", ...}]}  // lowercase effect invalid
// after
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":"*"}]}

// pre-check IAM permissions
iamSim := iam.SimulatePrincipalPolicyInput{PolicySourceArn: callerArn, ActionNames: []string{"iam:PutRolePolicy"}}

var awsErr smithy.APIError
if errors.As(err, &awsErr) {
  switch awsErr.ErrorCode() {
  case "NoSuchEntity": // role missing
  case "AccessDenied": // permissions
  case "Throttling": // retry
  }
}

err := cli.UpdateCluster(ctx, opts)
var apiErr smithy.APIError
if errors.As(err, &apiErr) && apiErr.ErrorCode() == "ThrottlingException" {
  time.Sleep(backoff); retry()
}

When it happens

Trigger: IAM PutRolePolicy returns any error: role does not exist yet/was deleted (NoSuchEntity), caller lacks iam:PutRolePolicy permission, policy size exceeds the IAM limit at the service side, throttling, or credential/STS problems.

Common situations: Using credentials without iam:Put* permissions; deleting/recreating an IAMRole in the same apply so the policy attaches to a missing role; AWS API throttling on large clusters; malformed policy rejected by IAM (MalformedPolicyDocument).

Related errors

• error creating AutoScalingGroup: %s
• error listing EventBridge rules: %v
• error getting role: %v
• error listing IAM role policies: %v
• error listing IAM role policies for %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2de289298061e3ed. Report an issue: GitHub.