kubernetes/kops · error

listing IAM roles: %w

Error message

listing IAM roles: %w

What it means

The paginated ListRoles call against AWS IAM failed while discovering roles to delete; an AWS API error such as throttling, credentials, or permissions on iam:ListRoles.

Source

Thrown at pkg/model/awsmodel/iam.go:475

		if err != nil {
			return nil, err
		}
		policy = strings.ReplaceAll(NodeRolePolicyTemplate, "{{ IAMServiceEC2 }}", ec2Service)
	}

	return fi.NewStringResource(policy), nil
}

func (b *IAMModelBuilder) FindDeletions(context *fi.CloudupModelBuilderContext, cloud fi.Cloud) error {
	ctx := context.Context()
	iamapi := cloud.(awsup.AWSCloud).IAM()
	ownershipTag := "kubernetes.io/cluster/" + b.Cluster.ObjectMeta.Name
	request := &awsiam.ListRolesInput{}
	paginator := awsiam.NewListRolesPaginator(iamapi, request)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return fmt.Errorf("listing IAM roles: %w", err)
		}
		for _, role := range page.Roles {
			if !strings.HasSuffix(fi.ValueOf(role.RoleName), "."+b.Cluster.ObjectMeta.Name) {
				continue
			}
			getRequest := &awsiam.GetRoleInput{RoleName: role.RoleName}
			roleOutput, err := iamapi.GetRole(ctx, getRequest)
			if err != nil {
				return fmt.Errorf("calling IAM GetRole on %s: %w", fi.ValueOf(role.RoleName), err)
			}
			for _, tag := range roleOutput.Role.Tags {
				if fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == "owned" {
					if _, ok := context.Tasks["IAMRole/"+fi.ValueOf(role.RoleName)]; !ok {
						context.AddTask(&awstasks.IAMRole{
							ID:        role.RoleId,
							Name:      role.RoleName,
							Lifecycle: b.Lifecycle,
						})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check AWS credentials and iam:ListRoles permissions
2. Retry — IAM throttling is common
3. Verify the AWS partition configuration

When it happens

Trigger: Thrown at pkg/model/awsmodel/iam.go:475 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/275b31892b246b80. Report an issue: GitHub.