kubernetes/kops · error

failed to get value for SSM parameter: %w

Error message

failed to get value for SSM parameter: %w

What it means

Returned by resolveSSMParameterValue (aws_cloud.go:1704) when ssm.GetParameter fails for the given parameter name. kops uses SSM public parameters to resolve AMI IDs for official images; any SSM-side failure is wrapped here with the AWS error attached.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1704

// ResolveImage finds an AMI image based on the given name.
// The name can be one of:
// `ami-...` in which case it is presumed to be an id
// owner/name in which case we find the image with the specified name, owned by owner
// name in which case we find the image with the specified name, with the current owner
func (c *awsCloudImplementation) ResolveImage(name string) (*ec2types.Image, error) {
	return resolveImage(context.TODO(), c.ssm, c.ec2, name)
}

func resolveSSMParameter(ctx context.Context, ssmClient awsinterfaces.SSMAPI, name string) (string, error) {
	klog.V(2).Infof("Resolving SSM parameter %q", name)
	request := &ssm.GetParameterInput{
		Name: aws.String(name),
	}

	response, err := ssmClient.GetParameter(ctx, request)
	if err != nil {
		return "", fmt.Errorf("failed to get value for SSM parameter: %w", err)
	}

	return aws.ToString(response.Parameter.Value), nil
}

func resolveImage(ctx context.Context, ssmClient awsinterfaces.SSMAPI, ec2Client awsinterfaces.EC2API, name string) (*ec2types.Image, error) {
	// TODO: Cache this result during a single execution (we get called multiple times)
	klog.V(2).Infof("Calling DescribeImages to resolve name %q", name)
	request := &ec2.DescribeImagesInput{}

	if strings.HasPrefix(name, "ami-") {
		// ami-xxxxxxxx
		request.ImageIds = []string{name}
	} else if strings.HasPrefix(name, "ssm:") {
		parameter := strings.TrimPrefix(name, "ssm:")

		image, err := resolveSSMParameter(ctx, ssmClient, parameter)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error: ParameterNotFound means check the parameter path and region; AccessDenied means fix IAM
2. Verify the parameter exists: `aws ssm get-parameter --name <name> --region <region>`
3. Grant ssm:GetParameter on the parameter ARN to the caller's IAM identity
4. Upgrade/downgrade kops if the SSM parameter path changed between versions

Example fix

// before
aws ssm get-parameter --name /aws/service/ami-windows-latest/...
# ParameterNotFound in us-west-1
// after
aws ssm get-parameter --name /aws/service/eks/optimized-ami/1.29/amazon-linux-2/recommended --region us-east-1

// Check SSM parameter readability before relying on it
_, err := ssmClient.GetParameter(ctx, &ssm.GetParameterInput{Name: aws.String(paramName)})
if err != nil { return fmt.Errorf("SSM parameter %s unavailable: %w", paramName, err) }

val, err := resolveSSMParameterValue(ctx, ssmClient, name)
if err != nil {
	var nf *ssmtypes.ParameterNotFound
	if errors.As(err, &nf) { /* fall back to a hardcoded AMI ID or alternate region */ }
	return err
}

When it happens

Trigger: ssmClient.GetParameter is called with Name=<parameter> and AWS returns an error: parameter does not exist, wrong region (SSM parameters are regional), missing ssm:GetParameter IAM permission, or throttling.

Common situations: Kops version references an SSM parameter path that changed; cluster region differs from where the parameter is published; IAM policy lacks ssm:GetParameter on the parameter ARN; transient SSM throttling.

Related errors

• error listing images: %v
• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• error listing hosted zones: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a755ac507a8dec55. Report an issue: GitHub.