diff --git a/pkg/workflows/workload/upgrade_test.go b/pkg/workflows/workload/upgrade_test.go
index 05fb1e2ad2cd..00764b9804b8 100644
--- a/pkg/workflows/workload/upgrade_test.go
+++ b/pkg/workflows/workload/upgrade_test.go
@@ -135,6 +135,11 @@ func (c *upgradeTestSetup) expectWriteWorkloadClusterConfig(err error) {
 	)
 }
 
+func (c *upgradeTestSetup) expectWithoutAWSIAMAuthKubeconfig(err error) {
+	c.clusterManager.EXPECT().GenerateAWSIAMKubeconfig(
+		c.ctx, c.clusterSpec.ManagementCluster).Return(err).Times(0)
+}
+
 func (c *upgradeTestSetup) expectDatacenterConfig() {
 	gomock.InOrder(
 		c.provider.EXPECT().DatacenterConfig(c.clusterSpec).Return(c.datacenterConfig).AnyTimes(),
@@ -189,6 +194,26 @@ func TestUpgradeRunSuccess(t *testing.T) {
 	}
 }
 
+func TestUpgradeRunWithAWSIAMSuccess(t *testing.T) {
+	features.ClearCache()
+	os.Setenv(features.UseControllerForCli, "true")
+	test := newUpgradeTest(t)
+	test.clusterSpec.AWSIamConfig = &v1alpha1.AWSIamConfig{}
+	test.expectSetup()
+	test.expectPreflightValidationsToPass()
+	test.expectDatacenterConfig()
+	test.expectMachineConfigs()
+	test.expectBackupWorkloadFromCluster(nil)
+	test.expectUpgradeWorkloadCluster(nil)
+	test.expectBuildClientFromKubeconfig(nil)
+	test.expectWriteWorkloadClusterConfig(nil)
+	test.expectWithoutAWSIAMAuthKubeconfig(nil)
+	err := test.run()
+	if err != nil {
+		t.Fatalf("Upgrade.Run() err = %v, want err = nil", err)
+	}
+}
+
 func TestUpgradeRunUpgradeFail(t *testing.T) {
 	features.ClearCache()
 	os.Setenv(features.UseControllerForCli, "true")
diff --git a/pkg/workflows/workload/writeclusterconfig.go b/pkg/workflows/workload/writeclusterconfig.go
index 4f36fbf63999..5cc563b3d180 100644
--- a/pkg/workflows/workload/writeclusterconfig.go
+++ b/pkg/workflows/workload/writeclusterconfig.go
@@ -20,7 +20,8 @@ func (s *writeClusterConfig) Run(ctx context.Context, commandContext *task.Comma
 
 	}
 
-	if commandContext.ClusterSpec.AWSIamConfig != nil {
+	// Generate AWS IAM kubeconfig only for cluster creation step
+	if commandContext.CurrentClusterSpec == nil && commandContext.ClusterSpec.AWSIamConfig != nil {
 		logger.Info("Generating the aws iam kubeconfig file")
 		err = commandContext.ClusterManager.GenerateAWSIAMKubeconfig(ctx, commandContext.ManagementCluster)
 		if err != nil {