kubernetes/kops · error

error listing IAM roles: %v

Error message

error listing IAM roles: %v

What it means

Fires in ListIAMRoles when paginated iam.ListRoles fails during cluster resource discovery — an AWS API, credentials, or throttling failure while enumerating roles, before cluster ownership tags are even checked.

Source

Thrown at pkg/resources/aws/aws.go:1998

	}

	return nil
}

func ListIAMRoles(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	var resourceTrackers []*resources.Resource
	// Find roles owned by the cluster
	{
		ownershipTag := "kubernetes.io/cluster/" + clusterName
		request := &iam.ListRolesInput{}
		paginator := iam.NewListRolesPaginator(c.IAM(), request)
		for paginator.HasMorePages() {
			page, err := paginator.NextPage(ctx)
			if err != nil {
				return nil, fmt.Errorf("error listing IAM roles: %v", err)
			}
			for _, r := range page.Roles {
				name := aws.ToString(r.RoleName)

				getRequest := &iam.GetRoleInput{RoleName: r.RoleName}
				roleOutput, err := c.IAM().GetRole(ctx, getRequest)
				if err != nil {
					if awsup.IsIAMNoSuchEntityException(err) {
						klog.Warningf("could not find role %q. Resource may already have been deleted: %v", name, err)
						continue
					} else if awsup.AWSErrorCode(err) == "403" {
						klog.Warningf("failed to determine ownership of %q: %v", name, err)
						continue
					}
					return nil, fmt.Errorf("calling IAM GetRole on %s: %w", name, err)
				}
				for _, tag := range roleOutput.Role.Tags {
					if fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == "owned" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify IAM credentials and iam:ListRoles permission
2. Retry after throttling errors
3. Check network/proxy connectivity to the IAM endpoint

When it happens

Trigger: Thrown at pkg/resources/aws/aws.go:1998 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e5d7f9e4d477687c. Report an issue: GitHub.