{"record":{"id":"24414ce5e58c848e","repo":"kubernetes/kops","slug":"error-creating-vpcdhcpoptionsassociation-v","errorCode":null,"errorMessage":"error creating VPCDHCPOptionsAssociation: %v","messagePattern":"error creating VPCDHCPOptionsAssociation: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpc_dhcpoptions_association.go","lineNumber":99,"sourceCode":"\t\t\treturn fi.CannotChangeField(\"VPC\")\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *VPCDHCPOptionsAssociation) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCDHCPOptionsAssociation) error {\n\tctx := context.TODO()\n\tif changes.DHCPOptions != nil {\n\t\tklog.V(2).Infof(\"calling EC2 AssociateDhcpOptions\")\n\t\trequest := &ec2.AssociateDhcpOptionsInput{\n\t\t\tVpcId:         e.VPC.ID,\n\t\t\tDhcpOptionsId: e.DHCPOptions.ID,\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().AssociateDhcpOptions(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating VPCDHCPOptionsAssociation: %v\", err)\n\t\t}\n\t}\n\n\treturn nil // no tags\n}\n\ntype terraformVPCDHCPOptionsAssociation struct {\n\tVPCID         *terraformWriter.Literal `cty:\"vpc_id\"`\n\tDHCPOptionsID *terraformWriter.Literal `cty:\"dhcp_options_id\"`\n}\n\nfunc (_ *VPCDHCPOptionsAssociation) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCDHCPOptionsAssociation) error {\n\ttf := &terraformVPCDHCPOptionsAssociation{\n\t\tVPCID:         e.VPC.TerraformLink(),\n\t\tDHCPOptionsID: e.DHCPOptions.TerraformLink(),\n\t}\n\n\treturn t.RenderResource(\"aws_vpc_dhcp_options_association\", *e.Name, tf)","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpc_dhcpoptions_association.go#L81-L117","documentation":"RenderAWS for VPCDHCPOptionsAssociation calls EC2 AssociateDhcpOptions to bind a DHCP options set to a VPC; failures are wrapped with this message. Without the association the VPC lacks DNS servers/domain settings needed by the cluster.","triggerScenarios":"AssociateDhcpOptions fails: referenced DhcpOptionsId or VpcId doesn't exist (wrong region/account), invalid ID format, throttling, or IAM lacking ec2:AssociateDhcpOptions.","commonSituations":"Cross-region mismatch between VPC and DHCP options set; options set deleted manually; shared VPC with restricted IAM; typo in IDs in the state/spec.","solutions":["Verify both IDs exist in the same region: `aws ec2 describe-dhcp-options` / `describe-vpcs`","Ensure IAM allows ec2:AssociateDhcpOptions","Re-run apply if throttled (RequestLimitExceeded)","If IDs were hand-edited, regenerate the spec with kops"],"exampleFix":"// before: options set in wrong region\nDhcpOptionsId: dopt-from-us-east-1  # cluster in us-west-2\n// after\nDhcpOptionsId: dopt-in-us-west-2","handlingStrategy":"try-catch","validationCode":"opts, err := ec2Client.DescribeDhcpOptions(ctx, &ec2.DescribeDhcpOptionsInput{DhcpOptionsIds: []string{doptID}})\nif err != nil || len(opts.DhcpOptions) == 0 { return fmt.Errorf(\"DHCP options %s missing in region\", doptID) }","typeGuard":null,"tryCatchPattern":"err := kopsApply()\nvar ae smithy.APIError\nif errors.As(err, &ae) {\n\tif ae.ErrorCode() == \"RequestLimitExceeded\" { retryWithBackoff() }\n\tif strings.HasPrefix(ae.ErrorCode(), \"Invalid\") { verifyIDsAndRegion() }\n}","preventionTips":["Keep VPC and DHCP options in the same region","Don't delete DHCP options sets referenced by live clusters","Grant ec2:AssociateDhcpOptions to the automation role","Run applies with retry/backoff on throttles"],"tags":["aws","ec2","dhcp","vpc","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}