{"record":{"id":"6f8314925b9cc5b0","repo":"kubernetes/kops","slug":"iam-instance-profile-not-yet-created-propagated-o","errorCode":null,"errorMessage":"IAM instance profile not yet created/propagated (original error: %v)","messagePattern":"IAM instance profile not yet created/propagated \\(original error: (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go","lineNumber":782,"sourceCode":"\t\ttime.Sleep(10 * time.Second)\n\n\t\t// Wrap the raw object as an Elastigroup.\n\t\teg, err := spotinst.NewElastigroup(cloud.ProviderID(), group)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// Create the Elastigroup.\n\t\t_, err = cloud.Spotinst().Elastigroup().Create(context.Background(), eg)\n\t\tif err == nil {\n\t\t\tbreak\n\t\t}\n\n\t\tif errs, ok := err.(client.Errors); ok {\n\t\t\tfor _, err := range errs {\n\t\t\t\tif strings.Contains(err.Message, \"Invalid IAM Instance Profile name\") {\n\t\t\t\t\tif attempt > maxAttempts {\n\t\t\t\t\t\treturn fmt.Errorf(\"IAM instance profile not yet created/propagated (original error: %v)\", err)\n\t\t\t\t\t}\n\n\t\t\t\t\tklog.V(4).Infof(\"Got an error indicating that the IAM instance profile %q is not ready %q\", fi.ValueOf(e.IAMInstanceProfile.Name), err)\n\t\t\t\t\tklog.Infof(\"Waiting for IAM instance profile %q to be ready\", fi.ValueOf(e.IAMInstanceProfile.Name))\n\t\t\t\t\tgoto readyLoop\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn fmt.Errorf(\"spotinst: failed to create elastigroup: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *Elastigroup) update(cloud awsup.AWSCloud, a, e, changes *Elastigroup) error {\n\tklog.V(2).Infof(\"Updating Elastigroup %q\", *e.Name)\n","sourceCodeStart":764,"sourceCodeEnd":800,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go#L764-L800","documentation":"When creating an Elastigroup, Spotinst may reject the IAM instance profile because AWS propagation has not completed. kOps retries with a readyLoop wait; if attempts exceed maxAttempts it surfaces this error including the original Spotinst error message. It is a timing/propagation failure of the AWS IAM profile referenced by the group.","triggerScenarios":"create() calls the Spotinst Create API, gets client.Errors containing \"Invalid IAM Instance Profile name\", and attempt > maxAttempts after repeatedly waiting for propagation.","commonSituations":"A brand-new cluster where the IAM instance profile was created seconds before the Elastigroup (AWS IAM eventual consistency); a typo'd or nonexistent instance profile name in the spec; IAM profile deleted out-of-band; very slow AWS propagation in a region.","solutions":["Verify the IAM instance profile name/ARN in the cluster spec actually exists in AWS: aws iam get-instance-profile --instance-profile-name <name>.","If it exists and is new, simply re-run `kops update cluster` after a minute — propagation usually completes.","If it does not exist, recreate the IAM resources (kops create secret/apply IAM templates) or fix the name in the spec.","Check the original error in the message for other IAM problems (permissions, wrong account)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify the instance profile exists before creating the group\n_, err := awsClient.IAM().GetInstanceProfile(&iam.GetInstanceProfileInput{\n    InstanceProfileName: aws.String(profileName),\n})\nif err != nil {\n    return fmt.Errorf(\"instance profile %q does not exist yet\", profileName)\n}","typeGuard":null,"tryCatchPattern":"if errs, ok := err.(client.Errors); ok {\n    for _, e := range errs {\n        if strings.Contains(e.Message, \"Invalid IAM Instance Profile name\") && attempt <= maxAttempts {\n            time.Sleep(30 * time.Second) // wait for IAM propagation, then retry\n            goto readyLoop\n        }\n    }\n}\nreturn fmt.Errorf(\"IAM instance profile not yet created/propagated (original error: %v)\", err)","preventionTips":["Create IAM instance profiles well before creating the Elastigroup","Prefer referencing existing profiles over brand-new ones in one run","On failure, wait ~1 minute and re-run update before debugging further","Validate profile existence with `aws iam get-instance-profile` preflight"],"tags":["spotinst","aws","iam","eventual-consistency"],"backgroundTag":"iam-propagation-delay","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}