kubernetes/kops · error

error untagging IAMInstanceProfile

Error message

error untagging IAMInstanceProfile: %v

What it means

During tag reconciliation, RenderAWS computes tags that exist on the profile but not in the spec and removes them with UntagInstanceProfile, wrapping API errors in this message. It surfaces when removing stale tags fails.

Solutions

1. Add iam:UntagInstanceProfile (and iam:ListInstanceProfileTags) to the kOps IAM policy.
2. Re-run the apply to clear throttling/transient failures.
3. Ensure tag keys in the spec are valid and no other automation is mutating the same profile concurrently.

// Diff tags before apply to know what will be untagged
aws iam list-instance-profile-tags --instance-profile-name <name>

// Retry transient failures; surface AccessDenied as IAM fix, not code fix
if code := awsup.AWSErrorCode(err); code == "Throttling" { backoff(); retry() }

When it happens

Trigger: UntagInstanceProfile fails: iam:UntagInstanceProfile/iam:TagInstanceProfile denied, throttling, tag keys exceeding limits or containing invalid characters, or concurrent modification of the profile.

Common situations: Tightened IAM policies that allow Tag but not Untag; removing many stale tags after a spec cleanup; two operators applying different tag sets simultaneously.

Related errors

• error adding AWS Tags to EBS Volume
• error creating IAMInstanceProfile
• error creating IAMInstanceProfileRole
• error getting IAMInstanceProfile
• error listing tags for EventBridge rule

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/10d072a07859f1ef. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go:156

			}
		}

		e.ID = response.InstanceProfile.InstanceProfileId
		e.Name = response.InstanceProfile.InstanceProfileName
	} else {
		if changes.Tags != nil {
			if len(a.Tags) > 0 {
				existingTagKeys := make([]string, 0)
				for k := range a.Tags {
					existingTagKeys = append(existingTagKeys, k)
				}
				untagRequest := &iam.UntagInstanceProfileInput{
					InstanceProfileName: a.Name,
					TagKeys:             existingTagKeys,
				}
				_, err := t.Cloud.IAM().UntagInstanceProfile(ctx, untagRequest)
				if err != nil {
					return fmt.Errorf("error untagging IAMInstanceProfile: %v", err)
				}
			}
			if len(e.Tags) > 0 {
				tagRequest := &iam.TagInstanceProfileInput{
					InstanceProfileName: a.Name,
					Tags:                mapToIAMTags(e.Tags),
				}
				_, err := t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)
				if err != nil {
					if awsup.AWSErrorCode(err) == awsup.AWSErrCodeInvalidAction {
						klog.Warningf("Ignoring unsupported IAMInstanceProfile tagging %v", *a.Name)
					} else {
						return fmt.Errorf("error tagging IAMInstanceProfile: %v", err)
					}
				}
			}
		}
	}

View on GitHub (pinned to 4c8573c808)