{"record":{"id":"5c3a73cab40b36e9","repo":"kubernetes/kops","slug":"error-getting-iaminstanceprofile-v","errorCode":null,"errorMessage":"error getting IAMInstanceProfile: %v","messagePattern":"error getting IAMInstanceProfile: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go","lineNumber":62,"sourceCode":"\nvar _ fi.CompareWithID = (*IAMInstanceProfile)(nil)\n\nfunc (e *IAMInstanceProfile) CompareWithID() *string {\n\treturn e.Name\n}\n\n// findIAMInstanceProfile retrieves the InstanceProfile with specified name\n// It returns nil,nil if not found\nfunc findIAMInstanceProfile(ctx context.Context, cloud awsup.AWSCloud, name string) (*iamtypes.InstanceProfile, error) {\n\trequest := &iam.GetInstanceProfileInput{InstanceProfileName: aws.String(name)}\n\n\tresponse, err := cloud.IAM().GetInstanceProfile(ctx, request)\n\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\treturn nil, nil\n\t}\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting IAMInstanceProfile: %v\", err)\n\t}\n\n\treturn response.InstanceProfile, nil\n}\n\nfunc (e *IAMInstanceProfile) Find(c *fi.CloudupContext) (*IAMInstanceProfile, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\tp, err := findIAMInstanceProfile(ctx, cloud, *e.Name)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif p == nil {\n\t\treturn nil, nil\n\t}\n","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go#L44-L80","documentation":"findIAMInstanceProfile calls IAM GetInstanceProfile by name; a NoSuchEntity is treated as 'not found' (returns nil,nil), but any other API error is wrapped in this message. It is a lookup failure during the Find/diff phase of reconciliation.","triggerScenarios":"GetInstanceProfile returns an unexpected error: iam:GetInstanceProfile denied, throttling (TooManyRequestsException), credentials/region misconfiguration, or malformed profile name.","commonSituations":"IAM policy grants list/create but not GetInstanceProfile; temporary IAM API throttling on accounts with many roles; running with STS credentials that expired mid-apply.","solutions":["Grant iam:GetInstanceProfile to the kOps IAM role.","Re-run the apply; throttling and transient credential issues usually clear.","Verify the instance profile name in the spec is correct and exists in the target account/region."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Verify the profile exists before apply\naws iam get-instance-profile --instance-profile-name <name>","typeGuard":null,"tryCatchPattern":"// NoSuchEntity is already treated as not-found; retry other transient errors\nif code := awsup.AWSErrorCode(err); code == \"Throttling\" || code == \"RequestLimitExceeded\" { backoff(); retry() }","preventionTips":["Grant iam:GetInstanceProfile in kOps policies","Refresh STS credentials before long applies","Keep profile names valid (<=128 chars)"],"tags":["aws","iam","instance-profile"],"backgroundTag":"aws-api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}