kubernetes/kops · error

error creating IAMInstanceProfile: %v

Error message

error creating IAMInstanceProfile: %v

What it means

CreateInstanceProfile failed during RenderAWS; common causes are an existing profile with the same name, missing iam:CreateInstanceProfile permission, or IAM eventual-consistency errors shortly after role creation.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go:125

	return nil
}

func (_ *IAMInstanceProfile) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMInstanceProfile) error {
	ctx := context.TODO()
	if fi.ValueOf(e.Shared) {
		if a == nil {
			return fmt.Errorf("instance role profile with id %q not found", fi.ValueOf(e.ID))
		}
	} else if a == nil {
		klog.V(2).Infof("Creating IAMInstanceProfile with Name:%q", *e.Name)

		request := &iam.CreateInstanceProfileInput{
			InstanceProfileName: e.Name,
		}

		response, err := t.Cloud.IAM().CreateInstanceProfile(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating IAMInstanceProfile: %v", err)
		}

		tagRequest := &iam.TagInstanceProfileInput{
			InstanceProfileName: e.Name,
			Tags:                mapToIAMTags(e.Tags),
		}
		_, err = t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)
		if err != nil {
			if awsup.AWSErrorCode(err) == awsup.AWSErrCodeInvalidAction {
				klog.Warningf("Ignoring unsupported IAMInstanceProfile tagging %v", *a.Name)
			} else {
				return fmt.Errorf("error tagging IAMInstanceProfile: %v", err)
			}
		}

		e.ID = response.InstanceProfile.InstanceProfileId
		e.Name = response.InstanceProfile.InstanceProfileName
	} else {

View on GitHub (pinned to 4c8573c808)

Solutions

1. If EntityAlreadyExists, import/adopt the existing profile (use Shared) or delete the orphaned one and re-apply.
2. Add iam:CreateInstanceProfile to the kOps IAM policy.
3. Shorten the profile name to <=128 characters and use valid characters.
4. Avoid concurrent applies against the same cluster to prevent races.

Example fix

// before: policy missing create
{"Action":["iam:GetInstanceProfile","iam:TagInstanceProfile"]}
// after
{"Action":["iam:GetInstanceProfile","iam:CreateInstanceProfile","iam:TagInstanceProfile","iam:AddRoleToInstanceProfile"]}

// Check for leftover profile from a prior run
aws iam get-instance-profile --instance-profile-name nodes.<cluster> 2>/dev/null || true

// Handle EntityAlreadyExists by adopting the existing profile
if awsup.AWSErrorCode(err) == "EntityAlreadyExists" {
    klog.Warningf("IAMInstanceProfile %q already exists; adopting", *e.Name)
    return nil
}

When it happens

Trigger: CreateInstanceProfile fails: profile name already exists (EntityAlreadyExists, e.g. race or out-of-band creation), iam:CreateInstanceProfile denied, name > 128 chars or invalid characters, throttling, or path issues.

Common situations: Re-creating a cluster whose IAM profile was left behind by a previous (partial) deletion; strict IAM policies without iam:CreateInstanceProfile; duplicate apply runs racing each other.

Related errors

• error getting IAMInstanceProfile: %v
• instance role profile with id %q not found
• error untagging IAMInstanceProfile: %v
• error creating IAMInstanceProfileRole: %v
• IP version is incorrect

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bc6e1c2fd1db569a. Report an issue: GitHub.