kubernetes/kops · error

error marshaling policy to JSON: %v

Error message

error marshaling policy to JSON: %v

What it means

json.Marshal of the assembled IAM policy statements failed inside AsJSON; with the statement types used this is effectively an internal error — an unmarshalable field value slipped into a statement.

Source

Thrown at pkg/model/iam/iam_builder.go:191

			},
		})
		// ec2:CreateSecurityGroup needs some special care as it also interacts with vpc, which do not support RequestTag.
		// We also do not require VPCs to be tagged, so we are not sending any conditions, allowing SGs to be created in any VPC.
		if p.clusterTaggedCreateAction.Has("ec2:CreateSecurityGroup") {
			statements = append(statements, &Statement{
				Effect:   StatementEffectAllow,
				Action:   stringorset.Of("ec2:CreateSecurityGroup"),
				Resource: stringorset.String(fmt.Sprintf("arn:%s:ec2:*:*:vpc/*", p.partition)),
			})
		}
	}
	if len(statements) == 0 {
		return "", nil
	}

	j, err := json.MarshalIndent(&Policy{Statement: statements, Version: p.Version}, "", "  ")
	if err != nil {
		return "", fmt.Errorf("error marshaling policy to JSON: %v", err)
	}
	return string(j), nil
}

// StatementEffect is required and specifies what type of access the statement results in
type StatementEffect string

// StatementEffectAllow allows access for the given resources in the statement (based on conditions)
const StatementEffectAllow StatementEffect = "Allow"

// StatementEffectDeny allows access for the given resources in the statement (based on conditions)
const StatementEffectDeny StatementEffect = "Deny"

// Condition is a map of Conditions to be evaluated for a given IAM Statement
type Condition map[string]interface{}

// Statement is an AWS IAM Policy Statement Object:
// http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Statement

View on GitHub (pinned to 4c8573c808)

Solutions

1. Report as a bug with the cluster's IAM configuration
2. Check for unusual values in additionalPolicies
3. Simplify the additional policy content

When it happens

Trigger: Thrown at pkg/model/iam/iam_builder.go:191 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e6325002a5d4bdc7. Report an issue: GitHub.