{"record":{"id":"d2521b690fe9e337","repo":"kubernetes/kops","slug":"unable-to-parse-instance-profile-name-from-arn-q","errorCode":null,"errorMessage":"unable to parse instance profile name from arn %q: %v","messagePattern":"unable to parse instance profile name from arn %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/iam.go","lineNumber":100,"sourceCode":"\tfor profileARN, igRole := range sharedProfileARNsToIGRole {\n\t\tlchPermissions := false\n\t\tdefaultWarmPool := b.Cluster.Spec.CloudProvider.AWS.WarmPool\n\t\tfor _, ig := range b.InstanceGroups {\n\t\t\twarmPool := defaultWarmPool.ResolveDefaults(ig)\n\t\t\tif ig.Spec.Role == igRole && warmPool.IsEnabled() && warmPool.EnableLifecycleHook {\n\t\t\t\tlchPermissions = true\n\t\t\t\tbreak\n\n\t\t\t}\n\t\t}\n\t\trole, err := iam.BuildNodeRoleSubject(igRole, lchPermissions)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tiamName, err := model.FindCustomAuthNameFromArn(profileARN)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to parse instance profile name from arn %q: %v\", profileARN, err)\n\t\t}\n\t\terr = b.buildIAMTasks(role, iamName, c, true)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// Generate IAM tasks for each managed role\n\tdefaultWarmPool := b.Cluster.Spec.CloudProvider.AWS.WarmPool\n\tfor igRole := range managedRoles {\n\t\thaveWarmPool := false\n\t\tfor _, ig := range b.InstanceGroups {\n\t\t\twarmPool := defaultWarmPool.ResolveDefaults(ig)\n\t\t\tif ig.Spec.Role == igRole && warmPool.IsEnabled() && warmPool.EnableLifecycleHook {\n\t\t\t\thaveWarmPool = true\n\t\t\t\tbreak\n\n\t\t\t}","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/iam.go#L82-L118","documentation":"kOps needs the instance profile NAME (not the full ARN) to build IAM tasks for a custom profile. When spec.iam.profile contains an ARN whose name segment cannot be extracted by FindCustomAuthNameFromArn (malformed ARN, wrong resource type, or not an instance-profile ARN at all), Build wraps the parse error with this message.","triggerScenarios":"Setting spec.iam.profile on an InstanceGroup to a malformed string (e.g. missing the trailing instance-profile path), to a role ARN instead of an instance-profile ARN, or to a truncated/partially-typed ARN.","commonSituations":"Users paste the ARN of the underlying IAM Role instead of the Instance Profile; extra path suffixes like :instance-profile/team/foo/bar that the parser does not expect; typos introduced while copying from the AWS console.","solutions":["Verify the value is a full instance-profile ARN of the form arn:aws:iam::<account>:instance-profile/<name> and fix typos.","Replace the ARN with just the instance profile name if supported, or re-copy the ARN from `aws iam list-instance-profiles`.","If using a path, simplify to a profile without a path segment."],"exampleFix":"// before\niam:\n  profile: arn:aws:iam::123456789012:role/MyRole\n// after\niam:\n  profile: arn:aws:iam::123456789012:instance-profile/MyProfile","handlingStrategy":"validation","validationCode":"re := regexp.MustCompile(`^arn:aws[a-zA-Z-]*:iam::\\d{12}:instance-profile/([A-Za-z0-9+=,.@_-]+)$`)\nif !re.MatchString(profileARN) {\n\treturn fmt.Errorf(\"not a valid instance-profile ARN: %s\", profileARN)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy profile ARNs from `aws iam get-instance-profile --instance-profile-name <name>` rather than hand-typing.","Never use a role ARN where an instance profile ARN is required.","Lint kops manifests in CI for iam.profile values matching the instance-profile ARN pattern."],"tags":["aws","iam","arn-parsing","config-validation"],"backgroundTag":"malformed-arn","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}