kubernetes/kops · error

error detaching IAM role policy %q %q: %v

Error message

error detaching IAM role policy %q %q: %v

What it means

Fires when iam.DetachRolePolicy fails to detach a managed policy from the IAM role during teardown — often a dependency violation if the policy/role is still in use, or a permissions/throttling error.

Source

Thrown at pkg/resources/aws/aws.go:1966

			RoleName:   aws.String(r.Name),
			PolicyName: aws.String(policyName),
		}
		_, err := c.IAM().DeleteRolePolicy(ctx, request)
		if err != nil {
			return fmt.Errorf("error deleting IAM role policy %q %q: %v", roleName, policyName, err)
		}
	}

	// Detach Managed Policies
	for _, policy := range attachedPolicies {
		klog.V(2).Infof("Detaching IAM role policy %q %v", roleName, policy)
		request := &iam.DetachRolePolicyInput{
			RoleName:  aws.String(r.Name),
			PolicyArn: policy.PolicyArn,
		}
		_, err := c.IAM().DetachRolePolicy(ctx, request)
		if err != nil {
			return fmt.Errorf("error detaching IAM role policy %q %q: %v", roleName, *policy.PolicyArn, err)
		}
	}

	// Delete Role
	{
		klog.V(2).Infof("Deleting IAM role %q", r.Name)
		request := &iam.DeleteRoleInput{
			RoleName: aws.String(r.Name),
		}
		_, err := c.IAM().DeleteRole(ctx, request)
		if err != nil {
			return fmt.Errorf("error deleting IAM role %q: %v", r.Name, err)
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check iam:DetachRolePolicy permission
2. Wait for dependencies (profiles still using the role) to clear, then retry
3. Inspect the wrapped AWS error code for DeleteConflict and re-run after dependencies are removed

When it happens

Trigger: Thrown at pkg/resources/aws/aws.go:1966 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9b9f9b48ce5c15a2. Report an issue: GitHub.