kubernetes/kops · error

error creating IAMInstanceProfileRole: %v

Error message

error creating IAMInstanceProfileRole: %v

What it means

Returned by IAMInstanceProfileRole.RenderAWS when the AddRoleToInstanceProfile IAM API call fails while attaching a role to an instance profile. This typically means the role could not be associated with the profile during cluster provisioning.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofilerole.go:106

		}
		if e.InstanceProfile == nil {
			return fi.RequiredField("InstanceProfile")
		}
	}
	return nil
}

func (_ *IAMInstanceProfileRole) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMInstanceProfileRole) error {
	ctx := context.TODO()
	if a == nil {
		request := &iam.AddRoleToInstanceProfileInput{
			InstanceProfileName: e.InstanceProfile.Name,
			RoleName:            e.Role.Name,
		}

		_, err := t.Cloud.IAM().AddRoleToInstanceProfile(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating IAMInstanceProfileRole: %v", err)
		}
	}
	return nil
}

type terraformIAMInstanceProfile struct {
	Name *string                  `cty:"name"`
	Role *terraformWriter.Literal `cty:"role"`
	Tags map[string]string        `cty:"tags"`
}

func (_ *IAMInstanceProfileRole) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMInstanceProfileRole) error {
	tf := &terraformIAMInstanceProfile{
		Name: e.InstanceProfile.Name,
		Role: e.Role.TerraformLink(),
		Tags: e.InstanceProfile.Tags,
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check whether the role is already attached to the instance profile in the AWS console; if so, re-run to let kOps reconcile state.
2. Verify SCPs / permission boundaries allow iam:AddRoleToInstanceProfile.
3. Wait a few seconds and retry — eventual consistency right after role creation commonly causes NoSuchEntity.
4. Ensure the instance profile has fewer than the maximum roles and that the role exists in the same account.

// pre-check role not already attached and profile below role limit
ip, _ := iamClient.GetInstanceProfileWithContext(ctx, &iam.GetInstanceProfileInput{InstanceProfileName: &profileName})
if ip != nil && len(ip.InstanceProfile.Roles) >= 10 { return errors.New("instance profile already at role limit") }

func isAlreadyAttached(err error, roleName string) bool { return err != nil && strings.Contains(err.Error(), roleName) }

err := retry.Do(func() error {
    _, err := iamClient.AddRoleToInstanceProfileWithContext(ctx, req)
    if err != nil && isNoSuchEntity(err) { return retry.TempError(err) } // eventual consistency
    return err
})

When it happens

Trigger: AddRoleToInstanceProfile fails: LimitExceededException (10 roles per instance profile), NoSuchEntityException (role or profile doesn't exist yet), or the role is already attached while kOps attempts to re-add it.

Common situations: AWS removed or restricted AddRoleToInstanceProfile in restricted accounts (e.g. SCPs denying it); profile already has the role but kOps' state was stale; eventual-consistency lag right after creating the role.

Related errors

• failed to generate AWS IAM Policy: %v
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q
• error building IAM policy: %v
• error getting IAMInstanceProfile: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/eedcb380126472e4. Report an issue: GitHub.