{"record":{"id":"eedcb380126472e4","repo":"kubernetes/kops","slug":"error-creating-iaminstanceprofilerole-v","errorCode":null,"errorMessage":"error creating IAMInstanceProfileRole: %v","messagePattern":"error creating IAMInstanceProfileRole: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iaminstanceprofilerole.go","lineNumber":106,"sourceCode":"\t\t}\n\t\tif e.InstanceProfile == nil {\n\t\t\treturn fi.RequiredField(\"InstanceProfile\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (_ *IAMInstanceProfileRole) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMInstanceProfileRole) error {\n\tctx := context.TODO()\n\tif a == nil {\n\t\trequest := &iam.AddRoleToInstanceProfileInput{\n\t\t\tInstanceProfileName: e.InstanceProfile.Name,\n\t\t\tRoleName:            e.Role.Name,\n\t\t}\n\n\t\t_, err := t.Cloud.IAM().AddRoleToInstanceProfile(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating IAMInstanceProfileRole: %v\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\ntype terraformIAMInstanceProfile struct {\n\tName *string                  `cty:\"name\"`\n\tRole *terraformWriter.Literal `cty:\"role\"`\n\tTags map[string]string        `cty:\"tags\"`\n}\n\nfunc (_ *IAMInstanceProfileRole) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMInstanceProfileRole) error {\n\ttf := &terraformIAMInstanceProfile{\n\t\tName: e.InstanceProfile.Name,\n\t\tRole: e.Role.TerraformLink(),\n\t\tTags: e.InstanceProfile.Tags,\n\t}\n","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iaminstanceprofilerole.go#L88-L124","documentation":"Returned by IAMInstanceProfileRole.RenderAWS when the AddRoleToInstanceProfile IAM API call fails while attaching a role to an instance profile. This typically means the role could not be associated with the profile during cluster provisioning.","triggerScenarios":"AddRoleToInstanceProfile fails: LimitExceededException (10 roles per instance profile), NoSuchEntityException (role or profile doesn't exist yet), or the role is already attached while kOps attempts to re-add it.","commonSituations":"AWS removed or restricted AddRoleToInstanceProfile in restricted accounts (e.g. SCPs denying it); profile already has the role but kOps' state was stale; eventual-consistency lag right after creating the role.","solutions":["Check whether the role is already attached to the instance profile in the AWS console; if so, re-run to let kOps reconcile state.","Verify SCPs / permission boundaries allow iam:AddRoleToInstanceProfile.","Wait a few seconds and retry — eventual consistency right after role creation commonly causes NoSuchEntity.","Ensure the instance profile has fewer than the maximum roles and that the role exists in the same account."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check role not already attached and profile below role limit\nip, _ := iamClient.GetInstanceProfileWithContext(ctx, &iam.GetInstanceProfileInput{InstanceProfileName: &profileName})\nif ip != nil && len(ip.InstanceProfile.Roles) >= 10 { return errors.New(\"instance profile already at role limit\") }","typeGuard":"func isAlreadyAttached(err error, roleName string) bool { return err != nil && strings.Contains(err.Error(), roleName) }","tryCatchPattern":"err := retry.Do(func() error {\n    _, err := iamClient.AddRoleToInstanceProfileWithContext(ctx, req)\n    if err != nil && isNoSuchEntity(err) { return retry.TempError(err) } // eventual consistency\n    return err\n})","preventionTips":["Wait for propagation after creating the role before attaching it to a profile","Verify SCPs and permission boundaries allow iam:AddRoleToInstanceProfile","Check the role isn't already attached before re-adding (profile supports max roles)","Keep role/profile creation and attachment in one reconciling tool"],"tags":["aws","iam","kops","instance-profile"],"backgroundTag":"iam-operation-unauthorized","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}