{"record":{"id":"00ab2119cca47607","repo":"kubernetes/kops","slug":"error-revoking-securitygroupingress-v","errorCode":null,"errorMessage":"error revoking SecurityGroupIngress: %v","messagePattern":"error revoking SecurityGroupIngress: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygroup.go","lineNumber":272,"sourceCode":"\t\t\tGroupId:              d.rule.GroupId,\n\t\t\tSecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},\n\t\t}\n\n\t\tklog.V(2).Infof(\"Calling EC2 RevokeSecurityGroupEgress\")\n\t\t_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupEgress(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error revoking SecurityGroupEgress: %v\", err)\n\t\t}\n\t} else {\n\t\trequest := &ec2.RevokeSecurityGroupIngressInput{\n\t\t\tGroupId:              d.rule.GroupId,\n\t\t\tSecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},\n\t\t}\n\n\t\tklog.V(2).Infof(\"Calling EC2 RevokeSecurityGroupIngress\")\n\t\t_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupIngress(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error revoking SecurityGroupIngress: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (d *deleteSecurityGroupRule) TaskName() string {\n\treturn \"SecurityGroupRule\"\n}\n\nfunc (d *deleteSecurityGroupRule) Item() string {\n\ts := fi.ValueOf(d.rule.GroupId) + \":\"\n\tp := d.rule\n\tif aws.ToInt32(p.FromPort) != 0 {\n\t\ts += fmt.Sprintf(\" port=%d\", aws.ToInt32(p.FromPort))\n\t\tif aws.ToInt32(p.ToPort) != aws.ToInt32(p.FromPort) {\n\t\t\ts += fmt.Sprintf(\"-%d\", aws.ToInt32(p.ToPort))\n\t\t}","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygroup.go#L254-L290","documentation":"Wraps a failure from the EC2 RevokeSecurityGroupIngress API while deleteSecurityGroupRule.Delete removes an extra ingress rule from a security group during reconciliation. The underlying AWS error is passed through unchanged. Taken when d.rule.IsEgress is false, i.e. the stale rule is an ingress rule.","triggerScenarios":"A CloudupDeletion for an ingress rule (matched by removeExtraRules in FindDeletions) triggers RevokeSecurityGroupIngress, which fails with InvalidGroup.NotFound (SG gone), InvalidPermission.NotFound/InvalidSecurityGroupRuleId.NotFound (rule already revoked or stale ID), throttling, or credential errors.","commonSituations":"Manual rule deletion in AWS console concurrent with kops apply; two kops runs racing; VPC/SG deleted by another automation (e.g. terraform) before revoke; region/credential misconfiguration in the kops state store or environment.","solutions":["Re-run `kops update cluster --yes`; stale-rule and already-deleted cases resolve on retry","Verify the rule/group still exists with `aws ec2 describe-security-group-rules --filter Name=group-id,Values=<sg-id>`","Confirm valid credentials and ec2:RevokeSecurityGroupIngress permission (`aws sts get-caller-identity`)","If throttled, wait and retry with fewer concurrent applies"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Confirm the ingress rule still exists before/instead of a blind revoke:\naws ec2 describe-security-group-rules \\\n  --filters Name=group-id,Values=$SG_ID \\\n  --query 'SecurityGroupRules[?IsEgress==`false`].[SecurityGroupRuleId,FromPort,ToPort]'","typeGuard":null,"tryCatchPattern":"if err := apply(); err != nil {\n  if strings.Contains(err.Error(), \"error revoking SecurityGroupIngress\") {\n    // stale-rule / throttle cases heal on retry\n    time.Sleep(30 * time.Second); retryApply()\n  }\n}","preventionTips":["Never run overlapping kops applies; use a lock or CI serialization","Avoid console/terraform edits to kops-managed security groups","Dry-run before --yes to review deletions","Grant ec2:RevokeSecurityGroupIngress to the automation role"],"tags":["aws","ec2","security-group","revoke-ingress"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}