diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts
index 2696587e69..1f8d525ea8 100644
--- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts
+++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts
@@ -17,6 +17,13 @@ import AWS from 'aws-sdk';
 import AWSMock from 'aws-sdk-mock';
 import { AwsIamKubernetesAuthTranslator } from './AwsIamKubernetesAuthTranslator';
 
+const awsError: AWS.AWSError = {
+  code: '123',
+  message: 'no way',
+  name: 'nope',
+  time: new Date(),
+};
+
 describe('AwsIamKubernetesAuthTranslator tests', () => {
   let role: any = undefined;
   const credentials: any = {
@@ -84,6 +91,25 @@ describe('AwsIamKubernetesAuthTranslator tests', () => {
     expect(response.serviceAccountToken).toBeDefined();
   });
 
+  describe('When the credentials is failing', () => {
+    beforeEach(() => {
+      jest.spyOn(AWS.config, 'getCredentials').mockImplementation(cb => {
+        cb(awsError, null);
+      });
+    });
+    it('throws the right error', async () => {
+      const authTranslator = new AwsIamKubernetesAuthTranslator();
+      await expect(
+        authTranslator.decorateClusterDetailsWithAuth({
+          assumeRole: role,
+          name: 'test-cluster',
+          url: '',
+          authProvider: 'aws',
+        }),
+      ).rejects.toEqual(awsError);
+    });
+  });
+
   describe('When the role is assumed', () => {
     // These credentials are not real.
     // Pulled from example in docs: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html