{"record":{"id":"b59079f9dbaa324b","repo":"kubernetes/kops","slug":"calling-iam-getinstanceprofile-on-s-w","errorCode":null,"errorMessage":"calling IAM GetInstanceProfile on %s: %w","messagePattern":"calling IAM GetInstanceProfile on (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":2097,"sourceCode":"\tfor paginator.HasMorePages() {\n\t\tpage, err := paginator.NextPage(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing IAM instance profiles: %v\", err)\n\t\t}\n\t\tfor _, p := range page.InstanceProfiles {\n\t\t\tname := aws.ToString(p.InstanceProfileName)\n\n\t\t\tgetRequest := &iam.GetInstanceProfileInput{InstanceProfileName: p.InstanceProfileName}\n\t\t\tprofileOutput, err := c.IAM().GetInstanceProfile(ctx, getRequest)\n\t\t\tif err != nil {\n\t\t\t\tif awsup.IsIAMNoSuchEntityException(err) {\n\t\t\t\t\tklog.Warningf(\"could not find role %q. Resource may already have been deleted: %v\", name, err)\n\t\t\t\t\tcontinue\n\t\t\t\t} else if awsup.AWSErrorCode(err) == \"403\" {\n\t\t\t\t\tklog.Warningf(\"failed to determine ownership of %q: %v\", *p.InstanceProfileName, err)\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\treturn nil, fmt.Errorf(\"calling IAM GetInstanceProfile on %s: %w\", name, err)\n\t\t\t}\n\t\t\tfor _, tag := range profileOutput.InstanceProfile.Tags {\n\t\t\t\tif fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == \"owned\" {\n\t\t\t\t\tprofiles = append(profiles, p)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\n\tfor _, profile := range profiles {\n\t\tname := aws.ToString(profile.InstanceProfileName)\n\t\tresourceTracker := &resources.Resource{\n\t\t\tName:    name,\n\t\t\tID:      name,\n\t\t\tType:    \"iam-instance-profile\",\n\t\t\tDeleter: DeleteIAMInstanceProfile,","sourceCodeStart":2079,"sourceCodeEnd":2115,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L2079-L2115","documentation":"kOps wraps the AWS SDK error from iam.GetInstanceProfile after a profile was listed. NoSuchEntity and 403 are already filtered out with warnings (treated as already-deleted / not-owned), so this error is a genuinely unexpected failure fetching the profile detail used to inspect ownership tags. Note the message uses %w so errors.Is/As against smithy API errors works.","triggerScenarios":"GetInstanceProfile returns any error other than NoSuchEntityException and 403: throttling (TooManyRequests), AuthorizationQueryAccessDenied variants not matching the literal '403' code check, serialization or network errors.","commonSituations":"Mass deletions race with the listing (profile deleted between List and Get) — mitigated only for NoSuchEntity; heavy API usage causing IAM throttling; malformed instance profile state.","solutions":["Check the wrapped AWS error code via awsup.AWSErrorCode(err) or errors.As to identify the cause","If throttled, retry with backoff or reduce parallelism","If the profile was deleted concurrently, re-run the operation — the list is now stale","Verify credentials and region are correct for the cluster"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight permission check\n_, err := iamClient.GetInstanceProfile(ctx, &iam.GetInstanceProfileInput{InstanceProfileName: aws.String(name)})\n// ignore NotFound/403; fail fast on other codes before batch work","typeGuard":"func isRetryableIAM(err error) bool {\n  var ae smithy.APIError\n  return errors.As(err, &ae) && (ae.ErrorCode() == \"ThrottlingException\" || ae.ErrorCode() == \"TooManyRequests\" || ae.ErrorCode() == \"RequestLimitExceeded\")\n}","tryCatchPattern":"profiles, err := ListOwnedInstanceProfiles(ctx, cloud)\nif err != nil {\n  if isRetryableIAM(err) { /* exponential backoff retry */ }\n  return fmt.Errorf(\"instance profile ownership scan failed: %w\", err)\n}","preventionTips":["Retry transient IAM errors with exponential backoff","Don't delete profiles concurrently with the ownership scan","Keep IAM throttling budgets in mind on accounts with thousands of profiles","Use %w-wrapped errors with errors.As to branch on specific codes"],"tags":["aws","iam"],"backgroundTag":"aws-iam-get-instance-profile-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}