kubernetes/kops · error

error deleting IAM role policy %q: %v

Error message

error deleting IAM role policy %q: %v

What it means

When removing inline policies that should no longer exist, RenderAWS calls DeleteRolePolicy per policy name. Failures are wrapped with the specific policy name, pinpointing which inline policy could not be deleted.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:210

						klog.V(2).Infof("Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted")
						return nil
					}
					return fmt.Errorf("error listing IAM role policies for %v", err)
				}
				attachedPolicies = append(attachedPolicies, page.AttachedPolicies...)
			}
		}

		// Delete inline policies
		for _, policyName := range policyNames {
			klog.V(2).Infof("Deleting IAM role policy %q", policyName)
			request := &iam.DeleteRolePolicyInput{
				RoleName:   a.Name,
				PolicyName: aws.String(policyName),
			}
			_, err := t.Cloud.IAM().DeleteRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error deleting IAM role policy %q: %v", policyName, err)
			}
		}

		// Detach Managed Policies
		for _, policy := range attachedPolicies {
			klog.V(2).Infof("Detaching IAM role policy %v", policy)
			request := &iam.DetachRolePolicyInput{
				RoleName:  a.Name,
				PolicyArn: policy.PolicyArn,
			}
			_, err := t.Cloud.IAM().DetachRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error detaching IAM role policy %q: %v", *policy.PolicyArn, err)
			}
		}

		request := &iam.DeleteRoleInput{
			RoleName: a.Name,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run reconciliation; a NoSuchEntity race resolves itself on the next pass
2. Grant iam:DeleteRolePolicy (and iam:ListRolePolicies) to the reconciling principal
3. Back off and retry if throttling; delete policies in smaller batches
4. Check for DeleteConflict: ensure no dependent sessions/services block the policy removal

// re-check the policy still exists right before deleting
_, err := iamClient.GetRolePolicy(ctx, &iam.GetRolePolicyInput{RoleName: roleName, PolicyName: &policyName})
if err != nil { /* policy already gone; skip delete */ }

_, err := t.Cloud.IAM().DeleteRolePolicy(ctx, request)
if err != nil {
    if awsup.IsIAMNoSuchEntityException(err) {
        klog.V(2).Infof("policy %q already deleted; continuing", policyName)
    } else {
        return fmt.Errorf("error deleting IAM role policy %q: %w", policyName, err)
    }
}

When it happens

Trigger: iam.DeleteRolePolicy returns NoSuchEntity (race where policy vanished), AccessDenied, DeleteConflict (policy in use/last cannot delete), or throttling.

Common situations: kOps controller lacks iam:DeleteRolePolicy; concurrent reconciliation deletes the policy first (NoSuchEntity race); service-linked or conflicting state on the role; long update runs hitting rate limits.

Related errors

• error creating AutoScalingGroup: %s
• error listing EventBridge rules: %v
• error getting role: %v
• error listing IAM role policies: %v
• error listing IAM role policies for %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c9f7c9f304934f80. Report an issue: GitHub.