kubernetes/kops · error

error detaching IAM role policy %q: %v

Error message

error detaching IAM role policy %q: %v

What it means

kOps' IAMRole.RenderAWS detaches every policy attached to a role before deleting it. When the AWS IAM DetachRolePolicy call fails for any attached policy, the underlying SDK error is wrapped as 'error detaching IAM role policy %q: %v' and reconciliation of the task aborts. The %q is the policy ARN being detached.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:223

				RoleName:   a.Name,
				PolicyName: aws.String(policyName),
			}
			_, err := t.Cloud.IAM().DeleteRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error deleting IAM role policy %q: %v", policyName, err)
			}
		}

		// Detach Managed Policies
		for _, policy := range attachedPolicies {
			klog.V(2).Infof("Detaching IAM role policy %v", policy)
			request := &iam.DetachRolePolicyInput{
				RoleName:  a.Name,
				PolicyArn: policy.PolicyArn,
			}
			_, err := t.Cloud.IAM().DetachRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error detaching IAM role policy %q: %v", *policy.PolicyArn, err)
			}
		}

		request := &iam.DeleteRoleInput{
			RoleName: a.Name,
		}
		if _, err := t.Cloud.IAM().DeleteRole(ctx, request); err != nil {
			return fmt.Errorf("error deleting IAM role: %v", err)
		}
		return nil
	}

	policy, err := fi.ResourceAsString(e.RolePolicyDocument)
	if err != nil {
		return fmt.Errorf("error rendering RolePolicyDocument: %v", err)
	}

	if a == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Resolve the DeleteConflict: disassociate any instance profiles using the role, then rerun kOps
2. Check for NoSuchEntity in the wrapped error and re-run apply so kOps refreshes state
3. Grant the credentials iam:DetachRolePolicy (and iam:ListAttachedRolePolicies)
4. Retry after a short delay — IAM propagation after creation often causes transient failures

Example fix

// before: blindly retry apply
kops update cluster --yes

// after: clear the conflict first
aws iam list-instance-profiles-for-role --role-name masters.example.com
aws iam remove-role-from-instance-profile --instance-profile-name X --role-name masters.example.com
kops update cluster --yes

for _, p := range attachedPolicies {
    if p.PolicyArn == policyARNToDelete {
        conflict = listInstanceProfilesForRole(roleName) // must be empty before delete
    }
}
if conflict != nil { return fmt.Errorf("role %s still in use", roleName) }

// kOps flattens the AWS error to a string, so match on content
if strings.Contains(err.Error(), "DeleteConflict") {
    // disassociate instance profiles, then retry apply
} else if strings.Contains(err.Error(), "NoSuchEntity") {
    // already detached; safe to continue
}

When it happens

Trigger: DetachRolePolicy returns NoSuchEntity (role or policy already gone), DeleteConflict (role still in use by an instance profile or the policy cannot be detached), AccessDenied (credentials lack iam:DetachRolePolicy), or an IAM throttling/propagation error right after role creation.

Common situations: Deleting a cluster whose role is still attached to an instance profile created outside kOps; a manually created service-linked or shared policy; IAM eventual-consistency delay after policy creation; restricted CI credentials; policy ARNs changed between kOps versions.

Related errors

• error deleting IAM role: %v
• error creating IAMRole: %v
• failed to generate AWS IAM Policy: %v
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0279f59aa1df9a78. Report an issue: GitHub.