{"record":{"id":"24f379a1656713c9","repo":"kubernetes/kops","slug":"error-deleting-tags-on-v-v","errorCode":null,"errorMessage":"error deleting tags on %v: %v","messagePattern":"error deleting tags on (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":1333,"sourceCode":"\t\t}\n\n\t\t_, err := c.EC2().DeleteTags(ctx, request)\n\t\tif err != nil {\n\t\t\tif isTagsEventualConsistencyError(err) {\n\t\t\t\tif attempt > DeleteTagsMaxAttempts {\n\t\t\t\t\treturn fmt.Errorf(\"got retryable error while deleting tags on %q, but retried too many times without success: %v\", resourceID, err)\n\t\t\t\t}\n\n\t\t\t\tif (attempt % DeleteTagsLogInterval) == 0 {\n\t\t\t\t\tklog.Infof(\"waiting for eventual consistency while deleting tags on %q\", resourceID)\n\t\t\t\t}\n\n\t\t\t\tklog.V(2).Infof(\"will retry after encountering error deleting tags on %q: %v\", resourceID, err)\n\t\t\t\ttime.Sleep(DeleteTagsRetryInterval)\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\treturn fmt.Errorf(\"error deleting tags on %v: %v\", resourceID, err)\n\t\t}\n\n\t\treturn nil\n\t}\n}\n\n// UpdateTags will update tags of the specified resource to match tags,\n// using getTags(), createTags() and deleteTags()\nfunc (c *awsCloudImplementation) UpdateTags(resourceID string, tags map[string]string) error {\n\treturn updateTags(c, resourceID, tags)\n}\n\nfunc updateTags(c AWSCloud, resourceID string, expectedTags map[string]string) error {\n\tactual, err := getTags(c, resourceID)\n\tif err != nil {\n\t\treturn err\n\t}\n","sourceCodeStart":1315,"sourceCodeEnd":1351,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L1315-L1351","documentation":"kOps returns this when DeleteTags on an EC2 resource fails with a non-retryable error — any failure that is not recognized by isTagsEventualConsistencyError. It is the terminal error for tag deletion: no further retries are made.","triggerScenarios":"EC2 DeleteTags called with an invalid or non-existent resourceID, missing iam:DeleteTags/CreateTags permission, or a request limit / credential error that is not classified as eventually-consistent.","commonSituations":"IAM policy for the kops controller lacking ec2:DeleteTags; deleting tags on a resource that was already terminated; stale credentials or expired session tokens; typo'd resource ID.","solutions":["Check IAM permissions: ensure the principal has ec2:DeleteTags and ec2:CreateTags on the resource.","Verify the resource exists and the ID is correct via `aws ec2 describe-tags`.","Read the wrapped %v detail for the underlying AWS error code (AuthFailure, InvalidID.NotFound, Throttling, etc.) and address accordingly.","Refresh AWS credentials / check region configuration if the error is auth-related."],"exampleFix":"// before: failing due to missing IAM action\n// policy missing ec2:DeleteTags\n// after: add required actions to the policy\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:CreateTags\",\"ec2:DeleteTags\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// Check IAM permissions and resource existence beforehand\n_, err := ec2Client.DescribeTags(ctx, &ec2.DescribeTagsInput{Filters: []ec2types.Filter{{Name: aws.String(\"resource-id\"), Values: []string{resourceID}}}})\n// err != nil => resource not visible; skip DeleteTags","typeGuard":null,"tryCatchPattern":"err := cloud.DeleteTags(ctx, resourceID, tagKeys)\nif err != nil {\n    var nf smithy.APIError\n    if errors.As(err, &nf) && nf.ErrorCode() == \"InvalidID.NotFound\" {\n        klog.V(2).Infof(\"resource %s already gone; skipping tag deletion\", resourceID)\n        return nil\n    }\n    return fmt.Errorf(\"deleting tags on %s: %w\", resourceID, err)\n}","preventionTips":["Grant ec2:CreateTags and ec2:DeleteTags in the IAM policy","Treat InvalidID.NotFound as success in teardown code","Validate resource IDs before API calls","Rotate credentials before long-running operations"],"tags":["aws","ec2","tags","iam-permissions"],"backgroundTag":"aws-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}