{"record":{"id":"09297d35b074f667","repo":"kubernetes/kops","slug":"error-getting-iaminstanceprofile-v-09297d","errorCode":null,"errorMessage":"error getting IAMInstanceProfile: %v","messagePattern":"error getting IAMInstanceProfile: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iaminstanceprofilerole.go","lineNumber":59,"sourceCode":"func (e *IAMInstanceProfileRole) Find(c *fi.CloudupContext) (*IAMInstanceProfileRole, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\tif e.Role == nil || e.Role.ID == nil {\n\t\tklog.V(2).Infof(\"Role/RoleID not set\")\n\t\treturn nil, nil\n\t}\n\troleID := *e.Role.ID\n\n\trequest := &iam.GetInstanceProfileInput{InstanceProfileName: e.InstanceProfile.Name}\n\n\tresponse, err := cloud.IAM().GetInstanceProfile(ctx, request)\n\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\treturn nil, nil\n\t}\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting IAMInstanceProfile: %v\", err)\n\t}\n\n\tip := response.InstanceProfile\n\tfor _, role := range ip.Roles {\n\t\tif aws.ToString(role.RoleId) != roleID {\n\t\t\tcontinue\n\t\t}\n\t\tactual := &IAMInstanceProfileRole{}\n\t\tactual.InstanceProfile = &IAMInstanceProfile{ID: ip.InstanceProfileId, Name: ip.InstanceProfileName}\n\t\tactual.Role = &IAMRole{ID: role.RoleId, Name: role.RoleName}\n\n\t\t// Prevent spurious changes\n\t\tactual.Name = e.Name\n\t\tactual.Lifecycle = e.Lifecycle\n\n\t\treturn actual, nil\n\t}\n\treturn nil, nil","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iaminstanceprofilerole.go#L41-L77","documentation":"Returned by IAMInstanceProfileRole.Find in kOps when the GetInstanceProfile IAM API call fails with anything other than the expected NoSuchEntity exception (which is treated as 'not found' and returns nil). This wrapper indicates an unexpected failure reading the instance profile's current state from AWS.","triggerScenarios":"cloud.IAM().GetInstanceProfile fails during a Find/diff pass: invalid instance profile name characters, insufficient iam:GetInstanceProfile permission, throttling, or connectivity issues.","commonSituations":"Instance profile names containing characters AWS rejects (only alphanumeric, hyphen, underscore, up to 128 chars); IAM credentials missing read permissions; transient AWS API errors during kops update cluster --yes.","solutions":["Check the instance profile name in the cluster spec matches AWS constraints (^[\\w+=,.@-]+$, ≤128 chars).","Grant iam:GetInstanceProfile to the kOps IAM principal.","Retry the kops command — many failures here are transient throttling.","Verify the profile exists; if AWS returned a different error than NoSuchEntity despite deletion, clean up state and re-apply."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-validate the instance profile name against AWS constraints\nvar nameRe = regexp.MustCompile(`^[\\w+=,.@-]{1,128}$`)\nif !nameRe.MatchString(profileName) { return fmt.Errorf(\"invalid instance profile name %q\", profileName) }","typeGuard":"func isNoSuchEntity(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == \"NoSuchEntityException\" }","tryCatchPattern":"resp, err := iamClient.GetInstanceProfileWithContext(ctx, req)\nif err != nil {\n    if isNoSuchEntity(err) { return nil, nil } // treat as absent\n    return nil, fmt.Errorf(\"error getting IAMInstanceProfile: %w\", err)\n}","preventionTips":["Mirror kOps' NoSuchEntity-as-absent pattern instead of failing on missing entities","Keep instance profile names alphanumeric/hyphen/underscore only","Grant iam:GetInstanceProfile read permission","Retry transient throttling errors with exponential backoff"],"tags":["aws","iam","kops","lookup"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}