{"record":{"id":"07146a498c89cfe7","repo":"kubernetes/kops","slug":"error-creating-securitygroup-v","errorCode":null,"errorMessage":"error creating SecurityGroup: %v","messagePattern":"error creating SecurityGroup: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygroup.go","lineNumber":182,"sourceCode":"\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\t// Do we want to do any verification of the security group?\n\t\treturn nil\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating SecurityGroup with Name:%q VPC:%q\", *e.Name, *e.VPC.ID)\n\n\t\trequest := &ec2.CreateSecurityGroupInput{\n\t\t\tVpcId:             e.VPC.ID,\n\t\t\tGroupName:         e.Name,\n\t\t\tDescription:       e.Description,\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroup, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateSecurityGroup(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating SecurityGroup: %v\", err)\n\t\t}\n\n\t\te.ID = response.GroupId\n\t}\n\n\treturn t.AddAWSTags(*e.ID, e.Tags)\n}\n\ntype terraformSecurityGroup struct {\n\tName        *string                  `cty:\"name\"`\n\tVPCID       *terraformWriter.Literal `cty:\"vpc_id\"`\n\tDescription *string                  `cty:\"description\"`\n\tTags        map[string]string        `cty:\"tags\"`\n}\n\nfunc (_ *SecurityGroup) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *SecurityGroup) error {\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygroup.go#L164-L200","documentation":"CreateSecurityGroup failed during RenderAWS — usually a same-name group already exists in the VPC, a VPC misconfiguration, or missing ec2:CreateSecurityGroup permission; the wrapped error is the AWS API response.","triggerScenarios":"CreateSecurityGroup fails: InvalidGroup.Duplicate (a SG with that name already exists in the VPC), UnauthorizedOperation, InvalidVpcID.NotFound (VPC deleted or wrong region), or LimitExceeded (SG quota).","commonSituations":"Leftover security group from a prior failed cluster create with the same name; VPC deleted out-of-band while kOps state persists; AWS security group per-VPC quota exhausted; IAM missing ec2:CreateSecurityGroup.","solutions":["Read the wrapped cause: InvalidGroup.Duplicate — delete or import the existing SG with matching tags","InvalidVpcID.NotFound — verify the VPC exists in the configured region or fix spec network config","LimitExceeded — request a quota increase or delete unused SGs","UnauthorizedOperation — add ec2:CreateSecurityGroup to the IAM policy"],"exampleFix":"// remove leftover duplicate before re-running kops update\naws ec2 delete-security-group --group-id <leftover-sg-id>","handlingStrategy":"try-catch","validationCode":"aws ec2 describe-security-groups --filters Name=group-name,<sg-name> Name=vpc-id,<vpc-id> # detect pre-existing duplicate name\naws servicequotas get-service-quota --service-code ec2 --quota-code L-2D98A712 # SG quota","typeGuard":null,"tryCatchPattern":"if err != nil {\n  switch {\n  case strings.Contains(err.Error(), \"InvalidGroup.Duplicate\"):\n    // adopt or delete the existing SG, then re-run\n  case strings.Contains(err.Error(), \"InvalidVpcID.NotFound\"):\n    // fix VPC/region config\n  case strings.Contains(err.Error(), \"LimitExceeded\"):\n    // raise quota\n  }\n}","preventionTips":["Clean up resources from failed creates before retrying","Confirm region/VPC in the cluster spec matches reality","Monitor AWS SG quotas when creating many clusters"],"tags":["aws","security-group","api-error","quota"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}