kubernetes/kops · error

failed to generate AWS IAM Policy: %v

Error message

failed to generate AWS IAM Policy: %v

What it means

This is the top-level wrapper error from PolicyBuilder.BuildAWSPolicy in kOps' IAM policy generator. It fires when the role-specific BuildAWSPolicy implementation (e.g. for NodeRoleAPIServer, NodeRoleMaster, NodeRoleBastion) returns an error while assembling the IAM policy statements for a cluster role. It is a generic wrap of a lower-level failure such as an unparseable state-store VFS path or an unsupported storage backend.

Source

Thrown at pkg/model/iam/iam_builder.go:366

	Role                                  Subject
	UseServiceAccountExternalPermisssions bool
}

// BuildAWSPolicy builds a set of IAM policy statements based on the
// instance group type and IAM Legacy flag within the Cluster Spec
func (b *PolicyBuilder) BuildAWSPolicy() (*Policy, error) {
	// Retrieve all the KMS Keys in use
	for _, e := range b.Cluster.Spec.EtcdClusters {
		for _, m := range e.Members {
			if m.KmsKeyID != nil {
				b.KMSKeys = append(b.KMSKeys, *m.KmsKeyID)
			}
		}
	}

	p, err := b.Role.BuildAWSPolicy(b)
	if err != nil {
		return nil, fmt.Errorf("failed to generate AWS IAM Policy: %v", err)
	}

	return p, nil
}

func NewPolicy(clusterName, partition, region string) *Policy {
	p := &Policy{
		Version:                   PolicyDefaultVersion,
		clusterName:               clusterName,
		region:                    region,
		unconditionalAction:       sets.New[string](),
		clusterTaggedAction:       sets.New[string](),
		clusterTaggedCreateAction: sets.New[string](),
		kmsDataPlaneAction:        sets.New[string](),
		partition:                 partition,
	}
	return p
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped cause in the error message (the %v suffix) — it names the real failure (VFS parse error or 'path is not cluster readable').
2. Verify the state store URL: `kops get clusters --state <store>`; it must be a supported backend for AWS, typically s3://<bucket>.
3. Fix or recreate the cluster's configStore.base / etcd backupStore values in the cluster spec to valid s3:// paths.
4. If using tests or non-S3 filesystem paths, ensure the path type is one kOps can emulate (MemFSPath/FSPath are accepted; others are not).

Example fix

// before: malformed state store
stateStore := "s3:/my-bucket/cluster.example.com" // missing slash -> BuildVfsPath fails
// after
stateStore := "s3://my-bucket/cluster.example.com"

// Before generating IAM policies, validate the state store parses
store := os.Getenv("KOPS_STATE_STORE")
if _, err := vfs.Context.BuildVfsPath(store); err != nil {
    return fmt.Errorf("invalid KOPS_STATE_STORE %q: %w", store, err)
}

// Ensure the resolved path type is supported for AWS IAM
if _, ok := vfsPath.(*vfs.S3Path); !ok {
    return fmt.Errorf("state store must be s3:// for AWS IAM, got %T", vfsPath)
}

p, err := builder.BuildAWSPolicy()
if err != nil {
    if strings.Contains(err.Error(), "cannot parse VFS path") {
        // fix state store URL, then retry
    }
    return fmt.Errorf("BuildAWSPolicy: %w", err)
}

When it happens

Trigger: Calling PolicyBuilder.BuildAWSPolicy() (typically via PolicyResource.Open during `kops update cluster` or `kops create cluster`) when the role's BuildAWSPolicy returns an error — concretely when AddS3Permissions fails because the cluster state store (S3Path) or etcd backup store cannot be parsed as a VFS path or is not a supported backend type.

Common situations: Malformed --state store URL (e.g. typo in s3:// scheme, unsupported VFS backend like azure:// when building AWS IAM policies); state store configured for a cloud whose path type has no AWS IAM mapping; corrupted cluster config where ConfigStore.Base is empty or invalid.

Related errors

• error building IAM policy: %v
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q
• error getting IAMInstanceProfile: %v
• error creating IAMInstanceProfileRole: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/62da21a02e00ac65. Report an issue: GitHub.