{"record":{"id":"041bcd70664c580b","repo":"kubernetes/kops","slug":"getting-role-from-profile-s-v","errorCode":null,"errorMessage":"getting role from profile %s: %v","messagePattern":"getting role from profile (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/template_functions.go","lineNumber":875,"sourceCode":"\t\t}\n\n\t\tswitch cluster.GetCloudProvider() {\n\t\tcase kops.CloudProviderAWS:\n\t\t\tnodesRoles := sets.String{}\n\t\t\tfor _, ig := range tf.AllInstanceGroups {\n\t\t\t\tif ig.Spec.Role.HasNode() || ig.Spec.Role.HasAPIServer() {\n\t\t\t\t\tprofile, err := tf.LinkToIAMInstanceProfile(ig)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn \"\", fmt.Errorf(\"getting profile for ig %s: %v\", ig.Name, err)\n\t\t\t\t\t}\n\t\t\t\t\t// The IAM Instance Profile has not been created at this point if it is not specified.\n\t\t\t\t\t// Because the IAM Instance Profile and the IAM Role are created in IAMModelBuilder tasks.\n\t\t\t\t\t// Therefore, the IAM Role associated with IAM Instance Profile is acquired only when it is not specified.\n\t\t\t\t\tif ig.Spec.IAM != nil && ig.Spec.IAM.Profile != nil {\n\t\t\t\t\t\tc := tf.cloud.(awsup.AWSCloud)\n\t\t\t\t\t\troles, err := awsup.GetRolesInInstanceProfile(c, *profile.Name)\n\t\t\t\t\t\tif err != nil {\n\t\t\t\t\t\t\treturn \"\", fmt.Errorf(\"getting role from profile %s: %v\", *profile.Name, err)\n\t\t\t\t\t\t}\n\t\t\t\t\t\tnodesRoles.Insert(roles...)\n\t\t\t\t\t} else {\n\t\t\t\t\t\t// When the IAM Instance Profile is not specified, IAM Instance Profile is created by kOps.\n\t\t\t\t\t\t// In this case, the IAM Instance Profile name and IAM Role name are same.\n\t\t\t\t\t\t// So there is no problem even if IAM Instance Profile name is inserted as role name in nodesRoles.\n\t\t\t\t\t\tnodesRoles.Insert(*profile.Name)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tconfig.Server.Provider.AWS = &awsbootstrap.AWSVerifierOptions{\n\t\t\t\tNodesRoles:          nodesRoles.List(),\n\t\t\t\tRegion:              tf.Region,\n\t\t\t\tUseIPBasedNodeNames: fi.ValueOf(cluster.Spec.CloudProvider.AWS.UseIPBasedNodeNames),\n\t\t\t}\n\n\t\tcase kops.CloudProviderGCE:\n\t\t\tc := tf.cloud.(gce.GCECloud)","sourceCodeStart":857,"sourceCodeEnd":893,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/template_functions.go#L857-L893","documentation":"KopsControllerConfig builds the kops-controller static config. When an instance group specifies a custom IAM instance profile (ig.Spec.IAM.Profile), kOps must resolve the actual IAM role attached to that profile via awsup.GetRolesInInstanceProfile. This error wraps any AWS API failure (or empty/missing profile) encountered during that lookup.","triggerScenarios":"AWS cluster where an instance group sets spec.iam.profile but the profile does not exist in the account/region, the credentials lack iam:GetInstanceProfile/ListInstanceProfiles permission, throttling occurs, or the AWSCloud client call otherwise fails.","commonSituations":"Typo in the profile name in the cluster spec; profile created in a different account; IAM policy missing for the kOps controller; profile deleted after spec was written; cross-account setups without proper trust/permissions.","solutions":["Verify the IAM instance profile name in ig.Spec.IAM.Profile exists in the target AWS account/region (aws iam get-instance-profile --instance-profile-name <name>).","Ensure the credentials kOps uses have iam:GetInstanceProfile permission.","Re-run after transient AWS API errors (throttling) or reduce API call rate.","If the profile is wrong, remove spec.iam.profile so kOps creates its own profile/role."],"exampleFix":"// before (cluster.yaml)\niam:\n  profile: profle-name-typo\n// after\niam:\n  profile: nodes.cluster.example.com","handlingStrategy":"validation","validationCode":"// Go: validate the profile before rendering the config\nprof := *ig.Spec.IAM.Profile\nout, err := awsIamClient.GetInstanceProfile(&iam.GetInstanceProfileInput{InstanceProfileName: aws.String(prof)})\nif err != nil || out.InstanceProfile == nil {\n    return fmt.Errorf(\"instance profile %q not found or inaccessible: %w\", prof, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify instance profile existence with aws iam get-instance-profile before kops update","Grant kOps credentials iam:GetInstanceProfile","Keep spec.iam.profile names consistent across cluster lifecycle","Prefer letting kOps create the profile (omit spec.iam.profile) unless required"],"tags":["aws","iam","config"],"backgroundTag":"aws-iam-profile-lookup-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}