{"record":{"id":"10d072a07859f1ef","repo":"kubernetes/kops","slug":"error-untagging-iaminstanceprofile-v","errorCode":null,"errorMessage":"error untagging IAMInstanceProfile: %v","messagePattern":"error untagging IAMInstanceProfile: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go","lineNumber":156,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\te.ID = response.InstanceProfile.InstanceProfileId\n\t\te.Name = response.InstanceProfile.InstanceProfileName\n\t} else {\n\t\tif changes.Tags != nil {\n\t\t\tif len(a.Tags) > 0 {\n\t\t\t\texistingTagKeys := make([]string, 0)\n\t\t\t\tfor k := range a.Tags {\n\t\t\t\t\texistingTagKeys = append(existingTagKeys, k)\n\t\t\t\t}\n\t\t\t\tuntagRequest := &iam.UntagInstanceProfileInput{\n\t\t\t\t\tInstanceProfileName: a.Name,\n\t\t\t\t\tTagKeys:             existingTagKeys,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().UntagInstanceProfile(ctx, untagRequest)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error untagging IAMInstanceProfile: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif len(e.Tags) > 0 {\n\t\t\t\ttagRequest := &iam.TagInstanceProfileInput{\n\t\t\t\t\tInstanceProfileName: a.Name,\n\t\t\t\t\tTags:                mapToIAMTags(e.Tags),\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)\n\t\t\t\tif err != nil {\n\t\t\t\t\tif awsup.AWSErrorCode(err) == awsup.AWSErrCodeInvalidAction {\n\t\t\t\t\t\tklog.Warningf(\"Ignoring unsupported IAMInstanceProfile tagging %v\", *a.Name)\n\t\t\t\t\t} else {\n\t\t\t\t\t\treturn fmt.Errorf(\"error tagging IAMInstanceProfile: %v\", err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go#L138-L174","documentation":"During tag reconciliation, RenderAWS computes tags that exist on the profile but not in the spec and removes them with UntagInstanceProfile, wrapping API errors in this message. It surfaces when removing stale tags fails.","triggerScenarios":"UntagInstanceProfile fails: iam:UntagInstanceProfile/iam:TagInstanceProfile denied, throttling, tag keys exceeding limits or containing invalid characters, or concurrent modification of the profile.","commonSituations":"Tightened IAM policies that allow Tag but not Untag; removing many stale tags after a spec cleanup; two operators applying different tag sets simultaneously.","solutions":["Add iam:UntagInstanceProfile (and iam:ListInstanceProfileTags) to the kOps IAM policy.","Re-run the apply to clear throttling/transient failures.","Ensure tag keys in the spec are valid and no other automation is mutating the same profile concurrently."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Diff tags before apply to know what will be untagged\naws iam list-instance-profile-tags --instance-profile-name <name>","typeGuard":null,"tryCatchPattern":"// Retry transient failures; surface AccessDenied as IAM fix, not code fix\nif code := awsup.AWSErrorCode(err); code == \"Throttling\" { backoff(); retry() }","preventionTips":["Grant iam:UntagInstanceProfile alongside iam:TagInstanceProfile","Keep tag sets stable in the cluster spec to minimize churn","Avoid running multiple tag-mutating automations on the same profile"],"tags":["aws","iam","tags","instance-profile"],"backgroundTag":"aws-tagging-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}