{"record":{"id":"bc6e1c2fd1db569a","repo":"kubernetes/kops","slug":"error-creating-iaminstanceprofile-v","errorCode":null,"errorMessage":"error creating IAMInstanceProfile: %v","messagePattern":"error creating IAMInstanceProfile: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go","lineNumber":125,"sourceCode":"\treturn nil\n}\n\nfunc (_ *IAMInstanceProfile) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMInstanceProfile) error {\n\tctx := context.TODO()\n\tif fi.ValueOf(e.Shared) {\n\t\tif a == nil {\n\t\t\treturn fmt.Errorf(\"instance role profile with id %q not found\", fi.ValueOf(e.ID))\n\t\t}\n\t} else if a == nil {\n\t\tklog.V(2).Infof(\"Creating IAMInstanceProfile with Name:%q\", *e.Name)\n\n\t\trequest := &iam.CreateInstanceProfileInput{\n\t\t\tInstanceProfileName: e.Name,\n\t\t}\n\n\t\tresponse, err := t.Cloud.IAM().CreateInstanceProfile(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating IAMInstanceProfile: %v\", err)\n\t\t}\n\n\t\ttagRequest := &iam.TagInstanceProfileInput{\n\t\t\tInstanceProfileName: e.Name,\n\t\t\tTags:                mapToIAMTags(e.Tags),\n\t\t}\n\t\t_, err = t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == awsup.AWSErrCodeInvalidAction {\n\t\t\t\tklog.Warningf(\"Ignoring unsupported IAMInstanceProfile tagging %v\", *a.Name)\n\t\t\t} else {\n\t\t\t\treturn fmt.Errorf(\"error tagging IAMInstanceProfile: %v\", err)\n\t\t\t}\n\t\t}\n\n\t\te.ID = response.InstanceProfile.InstanceProfileId\n\t\te.Name = response.InstanceProfile.InstanceProfileName\n\t} else {","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go#L107-L143","documentation":"CreateInstanceProfile failed during RenderAWS; common causes are an existing profile with the same name, missing iam:CreateInstanceProfile permission, or IAM eventual-consistency errors shortly after role creation.","triggerScenarios":"CreateInstanceProfile fails: profile name already exists (EntityAlreadyExists, e.g. race or out-of-band creation), iam:CreateInstanceProfile denied, name > 128 chars or invalid characters, throttling, or path issues.","commonSituations":"Re-creating a cluster whose IAM profile was left behind by a previous (partial) deletion; strict IAM policies without iam:CreateInstanceProfile; duplicate apply runs racing each other.","solutions":["If EntityAlreadyExists, import/adopt the existing profile (use Shared) or delete the orphaned one and re-apply.","Add iam:CreateInstanceProfile to the kOps IAM policy.","Shorten the profile name to <=128 characters and use valid characters.","Avoid concurrent applies against the same cluster to prevent races."],"exampleFix":"// before: policy missing create\n{\"Action\":[\"iam:GetInstanceProfile\",\"iam:TagInstanceProfile\"]}\n// after\n{\"Action\":[\"iam:GetInstanceProfile\",\"iam:CreateInstanceProfile\",\"iam:TagInstanceProfile\",\"iam:AddRoleToInstanceProfile\"]}","handlingStrategy":"try-catch","validationCode":"// Check for leftover profile from a prior run\naws iam get-instance-profile --instance-profile-name nodes.<cluster> 2>/dev/null || true","typeGuard":null,"tryCatchPattern":"// Handle EntityAlreadyExists by adopting the existing profile\nif awsup.AWSErrorCode(err) == \"EntityAlreadyExists\" {\n    klog.Warningf(\"IAMInstanceProfile %q already exists; adopting\", *e.Name)\n    return nil\n}","preventionTips":["Clean up orphaned IAM profiles before re-creating clusters","Grant iam:CreateInstanceProfile in IAM","Avoid concurrent kops applies on the same cluster"],"tags":["aws","iam","instance-profile","create"],"backgroundTag":"iam-entity-already-exists","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}