kubernetes/kops · error

error listing IAM role policies: %v

Error message

error listing IAM role policies: %v

What it means

During RenderAWS, kOps pages through ListRolePolicies to inventory the role's inline policies. Non-NoSuchEntity errors from the paginator are wrapped as 'error listing IAM role policies'. This indicates the AWS listing call itself failed.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:176

		klog.V(2).Infof("Deleting IAM role %q", fi.ValueOf(a.Name))

		var attachedPolicies []iamtypes.AttachedPolicy
		var policyNames []string

		// List Inline policies
		{
			request := &iam.ListRolePoliciesInput{
				RoleName: a.Name,
			}
			paginator := iam.NewListRolePoliciesPaginator(t.Cloud.IAM(), request)
			for paginator.HasMorePages() {
				page, err := paginator.NextPage(ctx)
				if err != nil {
					if awsup.IsIAMNoSuchEntityException(err) {
						klog.V(2).Infof("Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted")
						return nil
					}
					return fmt.Errorf("error listing IAM role policies: %v", err)
				}
				policyNames = append(policyNames, page.PolicyNames...)
			}
		}

		// List Attached Policies
		{
			request := &iam.ListAttachedRolePoliciesInput{
				RoleName: a.Name,
			}
			paginator := iam.NewListAttachedRolePoliciesPaginator(t.Cloud.IAM(), request)
			for paginator.HasMorePages() {
				page, err := paginator.NextPage(ctx)
				if err != nil {
					if awsup.IsIAMNoSuchEntityException(err) {
						klog.V(2).Infof("Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted")
						return nil
					}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant iam:ListRolePolicies (and GetRolePolicy) to the reconciling principal
2. Retry the update; add backoff if throttling (TooManyRequests) is the wrapped cause
3. Verify the role still exists and the RoleName passed to the paginator is correct
4. Check AWS service health if failures are broad

Example fix

// before
{"Effect":"Deny","Action":"iam:List*","Resource":"*"}
// after
{"Effect":"Allow","Action":["iam:ListRolePolicies","iam:GetRolePolicy"],"Resource":"*"}

// pre-check permission with a cheap call before paginating
_, err := iamClient.ListRolePolicies(ctx, &iam.ListRolePoliciesInput{RoleName: roleName, MaxItems: aws.Int32(1)})
if err != nil { /* access or role problem; resolve before full listing */ }

page, err := paginator.NextPage(ctx)
if err != nil {
    if awsup.IsIAMNoSuchEntityException(err) { return nil }
    var tme *types.ThrottlingException
    if errors.As(err, &tme) { /* retry with exponential backoff */ }
    return fmt.Errorf("error listing IAM role policies: %w", err)
}

When it happens

Trigger: paginator.NextPage(ctx) on ListRolePolicies returns AccessDenied, throttling, or network error (NoSuchEntity is explicitly tolerated and treated as already-deleted).

Common situations: Missing iam:ListRolePolicies permission on the kOps controller; API throttling when reconciling many roles; transient AWS errors during large updates.

Related errors

• error listing IAM role policies for %v
• error describing instances: %v
• error listing AutoScaling LaunchTemplates: %v
• error listing IAM instance profiles: %v
• error creating AutoScalingGroup: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3b21bb5b9f90e5e5. Report an issue: GitHub.