kubernetes/kops · error

error getting IAMInstanceProfile: %v

Error message

error getting IAMInstanceProfile: %v

What it means

findIAMInstanceProfile calls IAM GetInstanceProfile by name; a NoSuchEntity is treated as 'not found' (returns nil,nil), but any other API error is wrapped in this message. It is a lookup failure during the Find/diff phase of reconciliation.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go:62

var _ fi.CompareWithID = (*IAMInstanceProfile)(nil)

func (e *IAMInstanceProfile) CompareWithID() *string {
	return e.Name
}

// findIAMInstanceProfile retrieves the InstanceProfile with specified name
// It returns nil,nil if not found
func findIAMInstanceProfile(ctx context.Context, cloud awsup.AWSCloud, name string) (*iamtypes.InstanceProfile, error) {
	request := &iam.GetInstanceProfileInput{InstanceProfileName: aws.String(name)}

	response, err := cloud.IAM().GetInstanceProfile(ctx, request)
	if awsup.IsIAMNoSuchEntityException(err) {
		return nil, nil
	}

	if err != nil {
		return nil, fmt.Errorf("error getting IAMInstanceProfile: %v", err)
	}

	return response.InstanceProfile, nil
}

func (e *IAMInstanceProfile) Find(c *fi.CloudupContext) (*IAMInstanceProfile, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	p, err := findIAMInstanceProfile(ctx, cloud, *e.Name)
	if err != nil {
		return nil, err
	}

	if p == nil {
		return nil, nil
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant iam:GetInstanceProfile to the kOps IAM role.
2. Re-run the apply; throttling and transient credential issues usually clear.
3. Verify the instance profile name in the spec is correct and exists in the target account/region.

// Verify the profile exists before apply
aws iam get-instance-profile --instance-profile-name <name>

// NoSuchEntity is already treated as not-found; retry other transient errors
if code := awsup.AWSErrorCode(err); code == "Throttling" || code == "RequestLimitExceeded" { backoff(); retry() }

When it happens

Trigger: GetInstanceProfile returns an unexpected error: iam:GetInstanceProfile denied, throttling (TooManyRequestsException), credentials/region misconfiguration, or malformed profile name.

Common situations: IAM policy grants list/create but not GetInstanceProfile; temporary IAM API throttling on accounts with many roles; running with STS credentials that expired mid-apply.

Related errors

• instance role profile with id %q not found
• error creating IAMInstanceProfile: %v
• error untagging IAMInstanceProfile: %v
• error creating IAMInstanceProfileRole: %v
• IP version is incorrect

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5c3a73cab40b36e9. Report an issue: GitHub.