kubernetes/kops · error

error getting IAMInstanceProfile

Error message

error getting IAMInstanceProfile: %v

What it means

Returned by IAMInstanceProfileRole.Find in kOps when the GetInstanceProfile IAM API call fails with anything other than the expected NoSuchEntity exception (which is treated as 'not found' and returns nil). This wrapper indicates an unexpected failure reading the instance profile's current state from AWS.

Solutions

1. Check the instance profile name in the cluster spec matches AWS constraints (^[\w+=,.@-]+$, ≤128 chars).
2. Grant iam:GetInstanceProfile to the kOps IAM principal.
3. Retry the kops command — many failures here are transient throttling.
4. Verify the profile exists; if AWS returned a different error than NoSuchEntity despite deletion, clean up state and re-apply.

// pre-validate the instance profile name against AWS constraints
var nameRe = regexp.MustCompile(`^[\w+=,.@-]{1,128}$`)
if !nameRe.MatchString(profileName) { return fmt.Errorf("invalid instance profile name %q", profileName) }

func isNoSuchEntity(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == "NoSuchEntityException" }

resp, err := iamClient.GetInstanceProfileWithContext(ctx, req)
if err != nil {
    if isNoSuchEntity(err) { return nil, nil } // treat as absent
    return nil, fmt.Errorf("error getting IAMInstanceProfile: %w", err)
}

When it happens

Trigger: cloud.IAM().GetInstanceProfile fails during a Find/diff pass: invalid instance profile name characters, insufficient iam:GetInstanceProfile permission, throttling, or connectivity issues.

Common situations: Instance profile names containing characters AWS rejects (only alphanumeric, hyphen, underscore, up to 128 chars); IAM credentials missing read permissions; transient AWS API errors during kops update cluster --yes.

Related errors

• error building IAM policy
• error creating IAMInstanceProfileRole
• error creating IAMOIDCProvider
• error creating IAMRole
• error deleting IAM role

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/09297d35b074f667. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofilerole.go:59

func (e *IAMInstanceProfileRole) Find(c *fi.CloudupContext) (*IAMInstanceProfileRole, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	if e.Role == nil || e.Role.ID == nil {
		klog.V(2).Infof("Role/RoleID not set")
		return nil, nil
	}
	roleID := *e.Role.ID

	request := &iam.GetInstanceProfileInput{InstanceProfileName: e.InstanceProfile.Name}

	response, err := cloud.IAM().GetInstanceProfile(ctx, request)
	if awsup.IsIAMNoSuchEntityException(err) {
		return nil, nil
	}

	if err != nil {
		return nil, fmt.Errorf("error getting IAMInstanceProfile: %v", err)
	}

	ip := response.InstanceProfile
	for _, role := range ip.Roles {
		if aws.ToString(role.RoleId) != roleID {
			continue
		}
		actual := &IAMInstanceProfileRole{}
		actual.InstanceProfile = &IAMInstanceProfile{ID: ip.InstanceProfileId, Name: ip.InstanceProfileName}
		actual.Role = &IAMRole{ID: role.RoleId, Name: role.RoleName}

		// Prevent spurious changes
		actual.Name = e.Name
		actual.Lifecycle = e.Lifecycle

		return actual, nil
	}
	return nil, nil

View on GitHub (pinned to 4c8573c808)