kubernetes/kops · error

error listing IAM role policies for %v

Error message

error listing IAM role policies for %v

What it means

RenderAWS similarly pages through ListAttachedRolePolicies to inventory managed policies attached to the role. A non-NoSuchEntity error from the paginator is wrapped with this message. Note the format verb only prints the error, not the role, so correlate via surrounding logs.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:195

				}
				policyNames = append(policyNames, page.PolicyNames...)
			}
		}

		// List Attached Policies
		{
			request := &iam.ListAttachedRolePoliciesInput{
				RoleName: a.Name,
			}
			paginator := iam.NewListAttachedRolePoliciesPaginator(t.Cloud.IAM(), request)
			for paginator.HasMorePages() {
				page, err := paginator.NextPage(ctx)
				if err != nil {
					if awsup.IsIAMNoSuchEntityException(err) {
						klog.V(2).Infof("Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted")
						return nil
					}
					return fmt.Errorf("error listing IAM role policies for %v", err)
				}
				attachedPolicies = append(attachedPolicies, page.AttachedPolicies...)
			}
		}

		// Delete inline policies
		for _, policyName := range policyNames {
			klog.V(2).Infof("Deleting IAM role policy %q", policyName)
			request := &iam.DeleteRolePolicyInput{
				RoleName:   a.Name,
				PolicyName: aws.String(policyName),
			}
			_, err := t.Cloud.IAM().DeleteRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error deleting IAM role policy %q: %v", policyName, err)
			}
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:ListAttachedRolePolicies to the caller's IAM policy
2. Retry if the wrapped error is throttling; spread reconciliation load
3. Confirm the role exists (list roles) in case it was deleted concurrently
4. Enable klog V(2) for context on which task/role was being rendered

// pre-flight permission check
_, err := iamClient.ListAttachedRolePolicies(ctx, &iam.ListAttachedRolePoliciesInput{RoleName: roleName, MaxItems: aws.Int32(1)})
if err != nil { /* fix access or role state before reconcile */ }

page, err := paginator.NextPage(ctx)
if err != nil {
    if awsup.IsIAMNoSuchEntityException(err) { return nil }
    var tme *types.ThrottlingException
    if errors.As(err, &tme) { /* retry with backoff */ }
    return fmt.Errorf("error listing attached policies for role: %w", err)
}

When it happens

Trigger: paginator.NextPage(ctx) on ListAttachedRolePolicies returns AccessDenied, throttling, or a transient AWS error (NoSuchEntity is tolerated).

Common situations: Controller policy lacks iam:ListAttachedRolePolicies; throttling during large reconciliations; role deleted concurrently by another process mid-render.

Related errors

• error listing IAM role policies: %v
• error describing instances: %v
• error listing AutoScaling LaunchTemplates: %v
• error listing IAM instance profiles: %v
• error creating AutoScalingGroup: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2a57725b60a37855. Report an issue: GitHub.