{"record":{"id":"15145bfc31c1dbda","repo":"kubernetes/kops","slug":"error-describing-vpc-v","errorCode":null,"errorMessage":"error describing VPC: %v","messagePattern":"error describing VPC: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":913,"sourceCode":"\t\t\t\tcluster.Spec.Networking.Subnets = append(cluster.Spec.Networking.Subnets, *subnet)\n\t\t\t}\n\t\t\tzoneToSubnetsMap[zoneName] = append(zoneToSubnetsMap[zoneName], subnet)\n\t\t}\n\t}\n\n\treturn zoneToSubnetsMap, nil\n}\n\nfunc getAWSZoneToSubnetProviderID(VPCID string, region string, subnetIDs []string) (map[string]string, error) {\n\tres := make(map[string]string)\n\tcloudTags := map[string]string{}\n\tawsCloud, err := awsup.NewAWSCloud(region, cloudTags)\n\tif err != nil {\n\t\treturn res, fmt.Errorf(\"error loading cloud: %v\", err)\n\t}\n\tvpcInfo, err := awsCloud.FindVPCInfo(VPCID)\n\tif err != nil {\n\t\treturn res, fmt.Errorf(\"error describing VPC: %v\", err)\n\t}\n\tif vpcInfo == nil {\n\t\treturn res, fmt.Errorf(\"VPC %q not found\", VPCID)\n\t}\n\tsubnetByID := make(map[string]*fi.SubnetInfo)\n\tfor _, subnetInfo := range vpcInfo.Subnets {\n\t\tsubnetByID[subnetInfo.ID] = subnetInfo\n\t}\n\tfor _, subnetID := range subnetIDs {\n\t\tsubnet, ok := subnetByID[subnetID]\n\t\tif !ok {\n\t\t\treturn res, fmt.Errorf(\"subnet %s not found in VPC %s\", subnetID, VPCID)\n\t\t}\n\t\tif res[subnet.Zone] != \"\" {\n\t\t\treturn res, fmt.Errorf(\"subnet %s and %s have the same zone\", subnetID, res[subnet.Zone])\n\t\t}\n\t\tres[subnet.Zone] = subnetID\n\t}","sourceCodeStart":895,"sourceCodeEnd":931,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L895-L931","documentation":"After loading the AWS client, getAWSZoneToSubnetProviderID calls awsCloud.FindVPCInfo(VPCID) to describe the VPC and enumerate its subnets. If the EC2 DescribeVpcs/DescribeSubnets API call fails (throttling, authz denial, network error), the SDK error is wrapped as \"error describing VPC: %v\" and returned to the caller (setupZones/setupTopology), aborting cluster creation.","triggerScenarios":"`kops create cluster --cloud aws ... --vpc vpc-xxx --subnets subnet-...` where the EC2 API call errors: IAM policy missing ec2:DescribeVpcs/ec2:DescribeSubnets, API throttling, network timeout, or stale credentials revoked mid-call.","commonSituations":"Restricted IAM roles on CI runners; corporate proxy blocking EC2 endpoints; throttling when running many kOps operations in parallel; SCPs denying EC2 describe actions.","solutions":["Grant the calling identity iam: ec2:DescribeVpcs and ec2:DescribeSubnets (check CloudTrail for the AccessDenied entry).","Retry on throttling errors; reduce parallel kOps invocations.","Verify network reachability to the regional EC2 endpoint (proxy/VPN/firewall).","Inspect the wrapped %v message for the exact AWS error code."],"exampleFix":"// before (IAM policy missing describe permissions)\n{\"Effect\": \"Deny\", \"Action\": [\"ec2:Describe*\"], \"Resource\": \"*\"}\n// after\n{\"Effect\": \"Allow\", \"Action\": [\"ec2:DescribeVpcs\", \"ec2:DescribeSubnets\"], \"Resource\": \"*\"}","handlingStrategy":"retry","validationCode":"out, err := exec.Command(\"aws\", \"ec2\", \"describe-vpcs\", \"--vpc-ids\", vpcID, \"--region\", region).Output()\nif err != nil {\n    return fmt.Errorf(\"cannot describe VPC %s in %s: %w\", vpcID, region, err)\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"error describing VPC\") {\n    if strings.Contains(err.Error(), \"Throttling\") {\n        time.Sleep(backoff); retry()\n    } else if strings.Contains(err.Error(), \"AccessDenied\") {\n        // surface IAM remediation to the operator\n    }\n}","preventionTips":["Grant ec2:DescribeVpcs/ec2:DescribeSubnets to the CI/kOps role.","Add exponential backoff for throttling instead of parallel kops runs.","Verify EC2 endpoint reachability (proxy/SCP) in the target region."],"tags":["aws","vpc","ec2-api","iam","cluster-creation"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}