{"record":{"id":"0b1388e16b40567c","repo":"kubernetes/kops","slug":"error-listing-iam-instance-profiles-v","errorCode":null,"errorMessage":"error listing IAM instance profiles: %v","messagePattern":"error listing IAM instance profiles: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":2082,"sourceCode":"\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc ListIAMInstanceProfiles(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\n\tvar profiles []iamtypes.InstanceProfile\n\townershipTag := \"kubernetes.io/cluster/\" + clusterName\n\n\trequest := &iam.ListInstanceProfilesInput{}\n\tpaginator := iam.NewListInstanceProfilesPaginator(c.IAM(), request)\n\tfor paginator.HasMorePages() {\n\t\tpage, err := paginator.NextPage(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing IAM instance profiles: %v\", err)\n\t\t}\n\t\tfor _, p := range page.InstanceProfiles {\n\t\t\tname := aws.ToString(p.InstanceProfileName)\n\n\t\t\tgetRequest := &iam.GetInstanceProfileInput{InstanceProfileName: p.InstanceProfileName}\n\t\t\tprofileOutput, err := c.IAM().GetInstanceProfile(ctx, getRequest)\n\t\t\tif err != nil {\n\t\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\t\tklog.Warningf(\"could not find role %q. Resource may already have been deleted: %v\", name, err)\n\t\t\t\t\tcontinue\n\t\t\t\t} else if awsup.AWSErrorCode(err) == \"403\" {\n\t\t\t\t\tklog.Warningf(\"failed to determine ownership of %q: %v\", *p.InstanceProfileName, err)\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\treturn nil, fmt.Errorf(\"calling IAM GetInstanceProfile on %s: %w\", name, err)\n\t\t\t}\n\t\t\tfor _, tag := range profileOutput.InstanceProfile.Tags {\n\t\t\t\tif fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == \"owned\" {","sourceCodeStart":2064,"sourceCodeEnd":2100,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L2064-L2100","documentation":"kOps wraps the raw AWS SDK error from iam.ListInstanceProfilesPaginator.NextPage with this message while enumerating IAM instance profiles for ownership/cluster-tag discovery. It means the IAM ListInstanceProfiles API call failed for a pager page, so the whole listing returns nil and this wrapped error. It is thrown by kOps's AWS resource-tracking code, not by IAM itself; the underlying cause is always in the wrapped err.","triggerScenarios":"IAM API returns an error during pagination: throttling (ThrottlingException/TooManyRequests), InvalidClientTokenId from bad/expired credentials, AccessDenied/UnauthorizedOperation from an IAM principal lacking iam:ListInstanceProfiles, or network/endpoint failures while iterating pages.","commonSituations":"Credentials rotated or expired mid-run; IAM policy attached to the instance role or CI user omits iam:ListInstanceProfiles; account-level IAM throttling when many parallel kOps jobs run; regional STS misconfiguration.","solutions":["Run `aws iam list-instance-profiles` with the same credentials/region to reproduce the raw error","If throttling, enable SDK retries/backoff or reduce concurrent kOps operations","If AccessDenied, add iam:ListInstanceProfiles to the caller's IAM policy","If InvalidClientTokenId, refresh credentials (aws sts get-caller-identity) and confirm AWS_REGION/AWS_PROFILE"],"exampleFix":"// before: policy without IAM read\n{\"Effect\":\"Deny\",\"NotAction\":\"iam:List*\",\"Resource\":\"*\"}\n// after: allow listing instance profiles\n{\"Effect\":\"Allow\",\"Action\":[\"iam:ListInstanceProfiles\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// preflight: verify IAM list permission\n_, err := iamClient.ListInstanceProfiles(ctx, &iam.ListInstanceProfilesInput{MaxItems: aws.Int32(1)})\nif err != nil { return fmt.Errorf(\"IAM list-instance-profiles preflight failed: %w\", err) }","typeGuard":"func isThrottling(err error) bool {\n  var ae smithy.APIError\n  return errors.As(err, &ae) && (ae.ErrorCode() == \"ThrottlingException\" || ae.ErrorCode() == \"TooManyRequests\")\n}","tryCatchPattern":"profiles, err := ListOwnedInstanceProfiles(ctx, cloud)\nvar ae smithy.APIError\nif errors.As(err, &ae) && isThrottling(err) {\n  // retry with backoff\n} else if err != nil {\n  klog.Warningf(\"skipping instance profile cleanup: %v\", err)\n}","preventionTips":["Grant iam:ListInstanceProfiles (and Get/Tag reads) to the operator principal before running kops","Rotate credentials before long-running delete jobs","Avoid running many kOps operations concurrently against one account","Set AWS_REGION explicitly to the cluster region"],"tags":["aws","iam","pagination"],"backgroundTag":"aws-iam-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}