{"record":{"id":"3b01301f954d1647","repo":"kubernetes/kops","slug":"iam-instance-profile-not-yet-created-propagated-o-3b0130","errorCode":null,"errorMessage":"IAM instance profile not yet created/propagated (original error: %v)","messagePattern":"IAM instance profile not yet created/propagated \\(original error: (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/spotinsttasks/ocean.go","lineNumber":638,"sourceCode":"\t\ttime.Sleep(10 * time.Second)\n\n\t\t// Wrap the raw object as an Ocean.\n\t\toc, err := spotinst.NewOcean(cloud.ProviderID(), ocean)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// Create a new Ocean.\n\t\t_, err = cloud.Spotinst().Ocean().Create(context.Background(), oc)\n\t\tif err == nil {\n\t\t\tbreak\n\t\t}\n\n\t\tif errs, ok := err.(client.Errors); ok {\n\t\t\tfor _, err := range errs {\n\t\t\t\tif strings.Contains(err.Message, \"Invalid IAM Instance Profile name\") {\n\t\t\t\t\tif attempt > maxAttempts {\n\t\t\t\t\t\treturn fmt.Errorf(\"IAM instance profile not yet created/propagated (original error: %v)\", err)\n\t\t\t\t\t}\n\n\t\t\t\t\tklog.V(4).Infof(\"Got an error indicating that the IAM instance profile %q is not ready %q\", fi.ValueOf(e.IAMInstanceProfile.Name), err)\n\t\t\t\t\tklog.Infof(\"Waiting for IAM instance profile %q to be ready\", fi.ValueOf(e.IAMInstanceProfile.Name))\n\t\t\t\t\tgoto readyLoop\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn fmt.Errorf(\"spotinst: failed to create ocean: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *Ocean) update(cloud awsup.AWSCloud, a, e, changes *Ocean) error {\n\tklog.V(2).Infof(\"Updating Ocean %q\", *e.Name)\n","sourceCodeStart":620,"sourceCodeEnd":656,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/spotinsttasks/ocean.go#L620-L656","documentation":"When creating an Ocean, the Spotinst API can reject the request with 'Invalid IAM Instance Profile name' because the IAM instance profile kops just created has not yet propagated in AWS. The create routine retries with backoff, and after exhausting maxAttempts it gives up with this message wrapping the original client error.","triggerScenarios":"Ocean create is retried maxAttempts times; each attempt the Spotinst API returns a client.Errors entry containing 'Invalid IAM Instance Profile name' because the instance profile is not yet visible.","commonSituations":"Brand-new instance group whose IAM instance profile was created seconds earlier; eventual consistency in AWS IAM; slow AWS region propagation; control-plane nodes referenced before IAM settles.","solutions":["Simply re-run kops update cluster / apply after a minute — the instance profile will have propagated","Verify the IAM instance profile exists: aws iam get-instance-profile --instance-profile-name <name>","Check IAM policies/permissions allow the kops principal to pass the role","If persistent, recreate the instance profile and wait for it to be attachable before applying"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"_, err := iam.GetInstanceProfile(&iam.GetInstanceProfileInput{Name: aws.String(profileName)})\nif err != nil {\n    return fmt.Errorf(\"instance profile %q not visible yet; wait before creating ocean\", profileName)\n}","typeGuard":null,"tryCatchPattern":"if errs, ok := err.(client.Errors); ok {\n    for _, e := range errs {\n        if strings.Contains(e.Message, \"Invalid IAM Instance Profile name\") {\n            // wait and retry; IAM propagation is eventual\n            time.Sleep(30 * time.Second)\n            continue\n        }\n    }\n    return err\n}","preventionTips":["Create IAM instance profiles well before referencing them in an Ocean","Add generous retry/backoff for IAM-related Spotinst errors","Verify instance profile exists with aws iam get-instance-profile before apply","Be aware of IAM eventual consistency when provisioning brand-new instance groups"],"tags":["spotinst","iam","instance-profile","propagation-delay","retry"],"backgroundTag":"iam-instance-profile-not-propagated","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}