kubernetes/kops · error

error deleting IAM role %q: %v

Error message

error deleting IAM role %q: %v

What it means

Fires when iam.DeleteRole fails after all inline policies were deleted and managed policies detached — the final role deletion API call errored, typically due to remaining dependencies or insufficient permissions.

Source

Thrown at pkg/resources/aws/aws.go:1978

		request := &iam.DetachRolePolicyInput{
			RoleName:  aws.String(r.Name),
			PolicyArn: policy.PolicyArn,
		}
		_, err := c.IAM().DetachRolePolicy(ctx, request)
		if err != nil {
			return fmt.Errorf("error detaching IAM role policy %q %q: %v", roleName, *policy.PolicyArn, err)
		}
	}

	// Delete Role
	{
		klog.V(2).Infof("Deleting IAM role %q", r.Name)
		request := &iam.DeleteRoleInput{
			RoleName: aws.String(r.Name),
		}
		_, err := c.IAM().DeleteRole(ctx, request)
		if err != nil {
			return fmt.Errorf("error deleting IAM role %q: %v", r.Name, err)
		}
	}

	return nil
}

func ListIAMRoles(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	var resourceTrackers []*resources.Resource
	// Find roles owned by the cluster
	{
		ownershipTag := "kubernetes.io/cluster/" + clusterName
		request := &iam.ListRolesInput{}
		paginator := iam.NewListRolesPaginator(c.IAM(), request)
		for paginator.HasMorePages() {
			page, err := paginator.NextPage(ctx)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure all instance profiles and policies referencing the role are removed first, then retry
2. Check iam:DeleteRole permission
3. Inspect the wrapped error for NoSuchEntity (already deleted) or DeleteConflict (dependencies)

When it happens

Trigger: Thrown at pkg/resources/aws/aws.go:1978 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/357a062370069f29. Report an issue: GitHub.