diff --git a/upup/pkg/fi/cloudup/awsup/aws_cloud.go b/upup/pkg/fi/cloudup/awsup/aws_cloud.go
index 0a70257e12..10b6d5e7f0 100644
--- a/upup/pkg/fi/cloudup/awsup/aws_cloud.go
+++ b/upup/pkg/fi/cloudup/awsup/aws_cloud.go
@@ -2100,7 +2100,7 @@ func GetInstanceCertificateNames(instances *ec2.DescribeInstancesOutput) (addrs
 		if iface.Ipv6Addresses != nil && len(iface.Ipv6Addresses) > 0 {
 			addrs = append(addrs, *iface.Ipv6Addresses[0].Ipv6Address)
 		}
-		if iface.Association.PublicIp != nil {
+		if iface.Association != nil && iface.Association.PublicIp != nil {
 			addrs = append(addrs, *iface.Association.PublicIp)
 		}
 	}