{"record":{"id":"b3344bf3a541d5c3","repo":"kubernetes/kops","slug":"error-tagging-iaminstanceprofile-v","errorCode":null,"errorMessage":"error tagging IAMInstanceProfile: %v","messagePattern":"error tagging IAMInstanceProfile: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go","lineNumber":137,"sourceCode":"\t\trequest := &iam.CreateInstanceProfileInput{\n\t\t\tInstanceProfileName: e.Name,\n\t\t}\n\n\t\tresponse, err := t.Cloud.IAM().CreateInstanceProfile(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating IAMInstanceProfile: %v\", err)\n\t\t}\n\n\t\ttagRequest := &iam.TagInstanceProfileInput{\n\t\t\tInstanceProfileName: e.Name,\n\t\t\tTags:                mapToIAMTags(e.Tags),\n\t\t}\n\t\t_, err = t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == awsup.AWSErrCodeInvalidAction {\n\t\t\t\tklog.Warningf(\"Ignoring unsupported IAMInstanceProfile tagging %v\", *a.Name)\n\t\t\t} else {\n\t\t\t\treturn fmt.Errorf(\"error tagging IAMInstanceProfile: %v\", err)\n\t\t\t}\n\t\t}\n\n\t\te.ID = response.InstanceProfile.InstanceProfileId\n\t\te.Name = response.InstanceProfile.InstanceProfileName\n\t} else {\n\t\tif changes.Tags != nil {\n\t\t\tif len(a.Tags) > 0 {\n\t\t\t\texistingTagKeys := make([]string, 0)\n\t\t\t\tfor k := range a.Tags {\n\t\t\t\t\texistingTagKeys = append(existingTagKeys, k)\n\t\t\t\t}\n\t\t\t\tuntagRequest := &iam.UntagInstanceProfileInput{\n\t\t\t\t\tInstanceProfileName: a.Name,\n\t\t\t\t\tTagKeys:             existingTagKeys,\n\t\t\t\t}\n\t\t\t\t_, err := t.Cloud.IAM().UntagInstanceProfile(ctx, untagRequest)\n\t\t\t\tif err != nil {","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go#L119-L155","documentation":"After creating the instance profile, RenderAWS tags it via TagInstanceProfile. Unsupported-tag errors (InvalidAction) are deliberately downgraded to a warning (older AWS partitions), but any other error is wrapped in this message.","triggerScenarios":"TagInstanceProfile fails with a non-InvalidAction error: iam:TagInstanceProfile denied, >50 tags supplied, invalid tag key/value characters, throttling.","commonSituations":"Cluster spec with more than 50 tags or tags containing invalid characters (e.g. 'aws:' reserved prefix); IAM policy missing the tagging action; operating against a non-standard AWS partition where tagging is unsupported (handled as warning).","solutions":["Grant iam:TagInstanceProfile to the kOps IAM role.","Reduce tags to 50 or fewer and remove the reserved 'aws:' key prefix and invalid characters.","If you see the InvalidAction warning, it is non-fatal — no action needed."],"exampleFix":"// before\ntags: {\"aws:cloudformation:stack\":\"x\", ...}  // >50 tags\n// after\nKeep <=50 tags, avoid reserved 'aws:' prefix","handlingStrategy":"validation","validationCode":"// Enforce tag limits before apply\nif len(e.Tags) > 50 {\n    return fmt.Errorf(\"IAMInstanceProfile supports at most 50 tags, got %d\", len(e.Tags))\n}\nfor k := range e.Tags {\n    if strings.HasPrefix(k, \"aws:\") {\n        return fmt.Errorf(\"tag key %q uses reserved prefix\", k)\n    }\n}","typeGuard":null,"tryCatchPattern":"// InvalidAction (tagging unsupported) is non-fatal — mirror kOps behavior\nif awsup.AWSErrorCode(err) == \"InvalidAction\" { klog.Warningf(\"tagging unsupported; skipping\") } else { return err }","preventionTips":["Keep clusters to <=50 IAM tags","Avoid reserved 'aws:' tag prefixes","Grant iam:TagInstanceProfile in IAM"],"tags":["aws","iam","tags"],"backgroundTag":"aws-tagging-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}