kubernetes/kops · error

error deleting IAMRolePolicy: %v

Error message

error deleting IAMRolePolicy: %v

What it means

When the rendered inline policy is empty, RenderAWS treats it as a deletion and calls DeleteRolePolicy. If AWS returns an error other than NoSuchEntity (already gone), kops wraps it as 'error deleting IAMRolePolicy' and aborts convergence.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:241

		return nil
	}

	if policy == "" {
		// A deletion

		request := &iam.DeleteRolePolicyInput{}
		request.RoleName = e.Role.Name
		request.PolicyName = e.Name

		klog.V(2).Infof("Deleting role policy %s/%s", aws.ToString(e.Role.Name), aws.ToString(e.Name))
		_, err = t.Cloud.IAM().DeleteRolePolicy(ctx, request)
		if err != nil {
			if awsup.IsIAMNoSuchEntityException(err) {
				klog.V(2).Infof("Got NoSuchEntity deleting role policy %s/%s; assuming does not exist", aws.ToString(e.Role.Name), aws.ToString(e.Name))
				return nil
			}
			return fmt.Errorf("error deleting IAMRolePolicy: %v", err)
		}
		return nil
	}

	doPut := false

	if a == nil {
		klog.V(2).Infof("Creating IAMRolePolicy")
		doPut = true
	} else if changes != nil {
		if changes.PolicyDocument != nil {
			klog.V(2).Infof("Applying changed role policy to %q:", *e.Name)

			actualPolicy, err := a.policyDocumentString()
			if err != nil {
				return fmt.Errorf("error reading actual policy document: %v", err)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error for the specific cause
2. Grant iam:DeleteRolePolicy to the kops credentials
3. Re-run `kops update cluster` — NoSuchEntity is tolerated, so races usually resolve on retry
4. Check whether the role/policy is concurrently managed by CloudFormation or another tool

Example fix

// IAM policy allowing lifecycle operations
{
  "Effect": "Allow",
  "Action": ["iam:PutRolePolicy","iam:GetRolePolicy","iam:DeleteRolePolicy"],
  "Resource": "*"
}

// pre-check deletion permission
_, err := iamClient.SimulatePrincipalPolicy(ctx, &iam.SimulatePrincipalPolicyInput{
  PolicySourceArn: aws.String(kopsRoleArn),
  ActionNames: []string{"iam:DeleteRolePolicy"},
})

err := kopsUpdate()
if err != nil && strings.Contains(err.Error(), "error deleting IAMRolePolicy") {
  if isThrottling(err) || isConcurrentMutation(err) {
    time.Sleep(backoff); retry(kopsUpdate)
  } // else inspect wrapped AWS error
}

When it happens

Trigger: DeleteRolePolicy fails with e.g. AccessDenied, LimitExceeded (too many inline policies during cleanup), throttling, or concurrency errors while removing a role's inline policy.

Common situations: Credentials lacking iam:DeleteRolePolicy; another controller/process deleting the same policy concurrently; IAM API throttling; deleted role returning unexpected (non-NoSuchEntity) errors.

Related errors

• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• error listing hosted zones: %w
• arn %q has unrecognized type

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4307f0dc2fe2527d. Report an issue: GitHub.