kubernetes/kops · error

instance role profile with id %q not found

Error message

instance role profile with id %q not found

What it means

RenderAWS for IAMInstanceProfile requires that when e.Shared is set, the shared profile already exists (a != nil from Find). If the existing profile could not be found, it fails with 'instance role profile with id %q not found'. This is a validation error, not an AWS API failure.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iaminstanceprofile.go:114

func (e *IAMInstanceProfile) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (s *IAMInstanceProfile) CheckChanges(a, e, changes *IAMInstanceProfile) error {
	if a != nil {
		if fi.ValueOf(e.Name) == "" && !fi.ValueOf(e.Shared) {
			return fi.RequiredField("Name")
		}
	}
	return nil
}

func (_ *IAMInstanceProfile) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMInstanceProfile) error {
	ctx := context.TODO()
	if fi.ValueOf(e.Shared) {
		if a == nil {
			return fmt.Errorf("instance role profile with id %q not found", fi.ValueOf(e.ID))
		}
	} else if a == nil {
		klog.V(2).Infof("Creating IAMInstanceProfile with Name:%q", *e.Name)

		request := &iam.CreateInstanceProfileInput{
			InstanceProfileName: e.Name,
		}

		response, err := t.Cloud.IAM().CreateInstanceProfile(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating IAMInstanceProfile: %v", err)
		}

		tagRequest := &iam.TagInstanceProfileInput{
			InstanceProfileName: e.Name,
			Tags:                mapToIAMTags(e.Tags),
		}
		_, err = t.Cloud.IAM().TagInstanceProfile(ctx, tagRequest)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the shared instance profile ID/name exists: aws iam get-instance-profile --instance-profile-name <name>.
2. Correct the shared value in the cluster spec (Shared/ID fields).
3. Remove the Shared flag to let kOps create and manage the profile itself.
4. Check iam:GetInstanceProfile permission so Find can resolve the shared profile.

Example fix

// before
shared: true
id: arn:aws:iam::123456789012:instance-profile/nodes.old
// after
shared: true
id: arn:aws:iam::123456789012:instance-profile/nodes.cluster-name.k8s.local

// Fail fast before apply when shared is set
if fi.ValueOf(e.Shared) && fi.ValueOf(e.ID) == "" {
    return fmt.Errorf("shared IAMInstanceProfile requires a valid ID")
}
aws iam get-instance-profile --instance-profile-name <name> || echo "shared profile missing"

When it happens

Trigger: Cluster spec sets a shared IAM instance profile (Shared=true) with an ID/name, but the referenced profile does not exist in the account or Find failed to resolve it before render.

Common situations: Typo in the shared profile ID/name; profile deleted out-of-band; cross-account profile referenced; IAM permissions prevented Find from seeing the profile.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• error getting IAMInstanceProfile: %v
• error creating IAMInstanceProfile: %v
• error untagging IAMInstanceProfile: %v
• error creating IAMInstanceProfileRole: %v
• IP version is incorrect

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2e3beeca87bbc7ca. Report an issue: GitHub.