kubernetes/kops · error

error tagging IAMInstanceProfile: %v

Error message

error tagging IAMInstanceProfile: %v

What it means

After creating the instance profile, RenderAWS tags it via TagInstanceProfile. Unsupported-tag errors (InvalidAction) are deliberately downgraded to a warning (older AWS partitions), but any other error is wrapped in this message.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go:137

		request := &iam.CreateInstanceProfileInput{
			InstanceProfileName: e.Name,
		}

		response, err := t.Cloud.IAM().CreateInstanceProfile(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating IAMInstanceProfile: %v", err)
		}

		tagRequest := &iam.TagInstanceProfileInput{
			InstanceProfileName: e.Name,
			Tags:                mapToIAMTags(e.Tags),
		}
		_, err = t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)
		if err != nil {
			if awsup.AWSErrorCode(err) == awsup.AWSErrCodeInvalidAction {
				klog.Warningf("Ignoring unsupported IAMInstanceProfile tagging %v", *a.Name)
			} else {
				return fmt.Errorf("error tagging IAMInstanceProfile: %v", err)
			}
		}

		e.ID = response.InstanceProfile.InstanceProfileId
		e.Name = response.InstanceProfile.InstanceProfileName
	} else {
		if changes.Tags != nil {
			if len(a.Tags) > 0 {
				existingTagKeys := make([]string, 0)
				for k := range a.Tags {
					existingTagKeys = append(existingTagKeys, k)
				}
				untagRequest := &iam.UntagInstanceProfileInput{
					InstanceProfileName: a.Name,
					TagKeys:             existingTagKeys,
				}
				_, err := t.Cloud.IAM().UntagInstanceProfile(ctx, untagRequest)
				if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant iam:TagInstanceProfile to the kOps IAM role.
2. Reduce tags to 50 or fewer and remove the reserved 'aws:' key prefix and invalid characters.
3. If you see the InvalidAction warning, it is non-fatal — no action needed.

Example fix

// before
tags: {"aws:cloudformation:stack":"x", ...}  // >50 tags
// after
Keep <=50 tags, avoid reserved 'aws:' prefix

// Enforce tag limits before apply
if len(e.Tags) > 50 {
    return fmt.Errorf("IAMInstanceProfile supports at most 50 tags, got %d", len(e.Tags))
}
for k := range e.Tags {
    if strings.HasPrefix(k, "aws:") {
        return fmt.Errorf("tag key %q uses reserved prefix", k)
    }
}

// InvalidAction (tagging unsupported) is non-fatal — mirror kOps behavior
if awsup.AWSErrorCode(err) == "InvalidAction" { klog.Warningf("tagging unsupported; skipping") } else { return err }

When it happens

Trigger: TagInstanceProfile fails with a non-InvalidAction error: iam:TagInstanceProfile denied, >50 tags supplied, invalid tag key/value characters, throttling.

Common situations: Cluster spec with more than 50 tags or tags containing invalid characters (e.g. 'aws:' reserved prefix); IAM policy missing the tagging action; operating against a non-standard AWS partition where tagging is unsupported (handled as warning).

Related errors

• provider ID cannot be empty
• error adding AWS Tags to EBS Volume: %v
• Unable to tag subnet %v
• error listing tags for EventBridge rule: %v
• error untagging IAMInstanceProfile: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b3344bf3a541d5c3. Report an issue: GitHub.