kubernetes/kops · error

error tagging IAMRole: %v

Error message

error tagging IAMRole: %v

What it means

After untagging stale keys, RenderAWS applies the desired tags via IAM TagRole with mapToIAMTags(e.Tags). Errors are wrapped as 'error tagging IAMRole: %v', the last step of the tag reconciliation branch.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:330

					existingTagKeys = append(existingTagKeys, k)
				}
				untagRequest := &iam.UntagRoleInput{
					RoleName: e.Name,
					TagKeys:  existingTagKeys,
				}
				_, err = t.Cloud.IAM().UntagRole(ctx, untagRequest)
				if err != nil {
					return fmt.Errorf("error untagging IAMRole: %v", err)
				}
			}
			if len(e.Tags) > 0 {
				tagRequest := &iam.TagRoleInput{
					RoleName: e.Name,
					Tags:     mapToIAMTags(e.Tags),
				}
				_, err = t.Cloud.IAM().TagRole(ctx, tagRequest)
				if err != nil {
					return fmt.Errorf("error tagging IAMRole: %v", err)
				}
			}
		}
	}
	return nil
}

type terraformIAMRole struct {
	Name                *string                  `cty:"name"`
	AssumeRolePolicy    *terraformWriter.Literal `cty:"assume_role_policy"`
	PermissionsBoundary *string                  `cty:"permissions_boundary"`
	Tags                map[string]string        `cty:"tags"`
}

func (_ *IAMRole) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMRole) error {
	policy, err := t.AddFileResource("aws_iam_role", *e.Name, "policy", e.RolePolicyDocument, false)
	if err != nil {
		return fmt.Errorf("error rendering RolePolicyDocument: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Keep total role tags at 50 or fewer — trim the cluster spec tag map
2. Validate key/value charset and lengths (key max 128, value max 256) before applying
3. For LimitExceeded caused by external tags, remove unused tags with aws iam untag-role first
4. Add iam:TagRole to the credentials and back off/retry on RequestLimitExceeded

Example fix

// before: 60 tags in spec -> LimitExceeded
"tags": {"t01":"v", "...": "...", "t60":"v"}

// after: consolidated under quota
"tags": {"ManagedBy":"kops", "Cluster":"prod-eu", "Team":"platform"}

if len(desiredTags) > 50 { return fmt.Errorf("IAM allows at most 50 tags; got %d", len(desiredTags)) }
for k, v := range desiredTags {
    if len(k) > 128 || len(v) > 256 { return fmt.Errorf("tag %q over IAM length limit", k) }
}
existing, _ := iamClient.ListRoleTags(&iam.ListRoleTagsInput{RoleName: &roleName})
if len(existing.Tags)+len(desiredTags) > 50 { return fmt.Errorf("role would exceed 50-tag quota") }

When it happens

Trigger: TagRole returns InvalidInput (invalid tag key/value format, reserved aws: prefix without permission), LimitExceeded (more than 50 tags on the role), NoSuchEntity (role gone), AccessDenied (missing iam:TagRole), or throttling during bulk updates.

Common situations: Very large cluster spec tag maps exceeding the 50-tag IAM quota; tags auto-added by other tooling pushing the role over quota; invalid characters in user-supplied tag values (e.g. newlines); region-wide IAM rate limits during cluster creation.

Related errors

• error untagging IAMRole: %v
• provider ID cannot be empty
• error adding AWS Tags to EBS Volume: %v
• Unable to tag subnet %v
• error listing tags for EventBridge rule: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/77d39119d873d8e1. Report an issue: GitHub.