Skip to content

Conversation

@guyrosenbaum
Copy link

@guyrosenbaum guyrosenbaum commented Dec 18, 2025

Fix: Prevent infinite loop in IAM role policy listing

Description

This PR fixes a potential infinite loop in getRoles when ListRolePolicies or ListAttachedRolePolicies pagination fails.

Previously, if an error occurred during pagination (e.g., NextPage returns an error), the code would log the error and continue. This could cause the loop to retry indefinitely if the paginator state didn't advance, leading to a flood of error logs and a hung process.

The fix replaces continue with break, ensuring that if a pagination error occurs for a specific role, we stop processing policies for that role and move on to the next role (or finish), preventing the infinite loop. This matches the behavior already present in getGroupPolicies.

Infinite Loop Scenario: Role Deletion

A specific scenario where this infinite loop occurs is if a Role is deleted during the execution of Terraformer:

  1. ListRoles retrieves a list of roles, including RoleA.
  2. Terraformer starts iterating over roles.
  3. Before or while processing RoleA, RoleA is deleted from AWS (out of band).
  4. ListRolePolicies (or ListAttachedRolePolicies) is called for RoleA.
  5. AWS returns a NoSuchEntity error because the role no longer exists.
  6. The code logs the error and executes continue.
  7. The loop restarts, calling NextPage again.
  8. Since the error didn't advance the paginator or clear the "has more pages" state, the error recurs indefinitely.
  9. This results in an infinite loop of error logs.

Changes

  • Replaced continue with break in getRoles for rolePoliciesPage loop.
  • Replaced continue with break in getRoles for roleAttachedPoliciesPage loop.

Verification

  • Verified compilation with go build ./providers/aws/....
  • Code analysis confirms this aligns with the safe pattern used in getGroupPolicies.

Replaced continue with break in getRoles pagination error handling to prevent infinite loops.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant