kubernetes/kops · error

error untagging IAMInstanceProfile: %v

Error message

error untagging IAMInstanceProfile: %v

What it means

During tag reconciliation, RenderAWS computes tags that exist on the profile but not in the spec and removes them with UntagInstanceProfile, wrapping API errors in this message. It surfaces when removing stale tags fails.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go:156

			}
		}

		e.ID = response.InstanceProfile.InstanceProfileId
		e.Name = response.InstanceProfile.InstanceProfileName
	} else {
		if changes.Tags != nil {
			if len(a.Tags) > 0 {
				existingTagKeys := make([]string, 0)
				for k := range a.Tags {
					existingTagKeys = append(existingTagKeys, k)
				}
				untagRequest := &iam.UntagInstanceProfileInput{
					InstanceProfileName: a.Name,
					TagKeys:             existingTagKeys,
				}
				_, err := t.Cloud.IAM().UntagInstanceProfile(ctx, untagRequest)
				if err != nil {
					return fmt.Errorf("error untagging IAMInstanceProfile: %v", err)
				}
			}
			if len(e.Tags) > 0 {
				tagRequest := &iam.TagInstanceProfileInput{
					InstanceProfileName: a.Name,
					Tags:                mapToIAMTags(e.Tags),
				}
				_, err := t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)
				if err != nil {
					if awsup.AWSErrorCode(err) == awsup.AWSErrCodeInvalidAction {
						klog.Warningf("Ignoring unsupported IAMInstanceProfile tagging %v", *a.Name)
					} else {
						return fmt.Errorf("error tagging IAMInstanceProfile: %v", err)
					}
				}
			}
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:UntagInstanceProfile (and iam:ListInstanceProfileTags) to the kOps IAM policy.
2. Re-run the apply to clear throttling/transient failures.
3. Ensure tag keys in the spec are valid and no other automation is mutating the same profile concurrently.

// Diff tags before apply to know what will be untagged
aws iam list-instance-profile-tags --instance-profile-name <name>

// Retry transient failures; surface AccessDenied as IAM fix, not code fix
if code := awsup.AWSErrorCode(err); code == "Throttling" { backoff(); retry() }

When it happens

Trigger: UntagInstanceProfile fails: iam:UntagInstanceProfile/iam:TagInstanceProfile denied, throttling, tag keys exceeding limits or containing invalid characters, or concurrent modification of the profile.

Common situations: Tightened IAM policies that allow Tag but not Untag; removing many stale tags after a spec cleanup; two operators applying different tag sets simultaneously.

Related errors

• provider ID cannot be empty
• error adding AWS Tags to EBS Volume: %v
• Unable to tag subnet %v
• error listing tags for EventBridge rule: %v
• error getting IAMInstanceProfile: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/10d072a07859f1ef. Report an issue: GitHub.