kubernetes/kops · error

error listing IAM instance profiles: %v

Error message

error listing IAM instance profiles: %v

What it means

kOps wraps the raw AWS SDK error from iam.ListInstanceProfilesPaginator.NextPage with this message while enumerating IAM instance profiles for ownership/cluster-tag discovery. It means the IAM ListInstanceProfiles API call failed for a pager page, so the whole listing returns nil and this wrapped error. It is thrown by kOps's AWS resource-tracking code, not by IAM itself; the underlying cause is always in the wrapped err.

Source

Thrown at pkg/resources/aws/aws.go:2082

		}
	}

	return nil
}

func ListIAMInstanceProfiles(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	var profiles []iamtypes.InstanceProfile
	ownershipTag := "kubernetes.io/cluster/" + clusterName

	request := &iam.ListInstanceProfilesInput{}
	paginator := iam.NewListInstanceProfilesPaginator(c.IAM(), request)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, fmt.Errorf("error listing IAM instance profiles: %v", err)
		}
		for _, p := range page.InstanceProfiles {
			name := aws.ToString(p.InstanceProfileName)

			getRequest := &iam.GetInstanceProfileInput{InstanceProfileName: p.InstanceProfileName}
			profileOutput, err := c.IAM().GetInstanceProfile(ctx, getRequest)
			if err != nil {
				if awsup.IsIAMNoSuchEntityException(err) {
					klog.Warningf("could not find role %q. Resource may already have been deleted: %v", name, err)
					continue
				} else if awsup.AWSErrorCode(err) == "403" {
					klog.Warningf("failed to determine ownership of %q: %v", *p.InstanceProfileName, err)
					continue
				}
				return nil, fmt.Errorf("calling IAM GetInstanceProfile on %s: %w", name, err)
			}
			for _, tag := range profileOutput.InstanceProfile.Tags {
				if fi.ValueOf(tag.Key) == ownershipTag && fi.ValueOf(tag.Value) == "owned" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws iam list-instance-profiles` with the same credentials/region to reproduce the raw error
2. If throttling, enable SDK retries/backoff or reduce concurrent kOps operations
3. If AccessDenied, add iam:ListInstanceProfiles to the caller's IAM policy
4. If InvalidClientTokenId, refresh credentials (aws sts get-caller-identity) and confirm AWS_REGION/AWS_PROFILE

Example fix

// before: policy without IAM read
{"Effect":"Deny","NotAction":"iam:List*","Resource":"*"}
// after: allow listing instance profiles
{"Effect":"Allow","Action":["iam:ListInstanceProfiles"],"Resource":"*"}

// preflight: verify IAM list permission
_, err := iamClient.ListInstanceProfiles(ctx, &iam.ListInstanceProfilesInput{MaxItems: aws.Int32(1)})
if err != nil { return fmt.Errorf("IAM list-instance-profiles preflight failed: %w", err) }

func isThrottling(err error) bool {
  var ae smithy.APIError
  return errors.As(err, &ae) && (ae.ErrorCode() == "ThrottlingException" || ae.ErrorCode() == "TooManyRequests")
}

profiles, err := ListOwnedInstanceProfiles(ctx, cloud)
var ae smithy.APIError
if errors.As(err, &ae) && isThrottling(err) {
  // retry with backoff
} else if err != nil {
  klog.Warningf("skipping instance profile cleanup: %v", err)
}

When it happens

Trigger: IAM API returns an error during pagination: throttling (ThrottlingException/TooManyRequests), InvalidClientTokenId from bad/expired credentials, AccessDenied/UnauthorizedOperation from an IAM principal lacking iam:ListInstanceProfiles, or network/endpoint failures while iterating pages.

Common situations: Credentials rotated or expired mid-run; IAM policy attached to the instance role or CI user omits iam:ListInstanceProfiles; account-level IAM throttling when many parallel kOps jobs run; regional STS misconfiguration.

Related errors

• error listing IAM role policies: %v
• error listing IAM role policies for %v
• error listing all versions of file %s: %v
• IP version is incorrect
• provider ID cannot be empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0b1388e16b40567c. Report an issue: GitHub.