{"record":{"id":"294b247a0e145027","repo":"kubernetes/kops","slug":"error-creating-dhcpoptions-v","errorCode":null,"errorMessage":"error creating DHCPOptions: %v","messagePattern":"error creating DHCPOptions: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dhcp_options.go","lineNumber":166,"sourceCode":"\t\t}\n\t\tif e.DomainNameServers != nil {\n\t\t\to := ec2types.NewDhcpConfiguration{\n\t\t\t\tKey:    aws.String(\"domain-name-servers\"),\n\t\t\t\tValues: []string{aws.ToString(e.DomainNameServers)},\n\t\t\t}\n\t\t\trequest.DhcpConfigurations = append(request.DhcpConfigurations, o)\n\t\t}\n\t\tif e.DomainName != nil {\n\t\t\to := ec2types.NewDhcpConfiguration{\n\t\t\t\tKey:    aws.String(\"domain-name\"),\n\t\t\t\tValues: []string{aws.ToString(e.DomainName)},\n\t\t\t}\n\t\t\trequest.DhcpConfigurations = append(request.DhcpConfigurations, o)\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateDhcpOptions(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating DHCPOptions: %v\", err)\n\t\t}\n\n\t\te.ID = response.DhcpOptions.DhcpOptionsId\n\t}\n\n\treturn t.AddAWSTags(*e.ID, e.Tags)\n}\n\ntype terraformDHCPOptions struct {\n\tDomainName        *string           `cty:\"domain_name\"`\n\tDomainNameServers []string          `cty:\"domain_name_servers\"`\n\tTags              map[string]string `cty:\"tags\"`\n}\n\nfunc (_ *DHCPOptions) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *DHCPOptions) error {\n\ttf := &terraformDHCPOptions{\n\t\tDomainName: e.DomainName,\n\t\tTags:       e.Tags,","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dhcp_options.go#L148-L184","documentation":"kops wraps every raw AWS SDK failure from EC2 CreateDhcpOptions with this message while rendering the DHCPOptions task in RenderAWS (dhcp_options.go:166). It means the EC2 CreateDhcpOptions API call failed to create the DHCP options set (domain-name / domain-name-servers) for the VPC. The underlying AWS error is appended via %v, so the real cause (auth, limit, invalid value, region) is in the wrapped text.","triggerScenarios":"EC2 CreateDhcpOptions fails: invalid DhcpConfigurations values, exceeding the per-region DHCP options set quota, credentials lacking ec2:CreateDhcpOptions permission, throttling, or region/endpoint issues. Also triggered when the following AddAWSTags call fails after partial creation.","commonSituations":"Cluster creation in a new AWS account near the DHCP options set limit; IAM policy restricting ec2:CreateDhcpOptions; malformed custom domain-name-servers values in the cluster spec; API throttling during large cluster creates.","solutions":["Read the wrapped %v text and fix the specific AWS error (InvalidParameterValue, LimitExceeded, UnauthorizedOperation, etc.)","If LimitExceeded: delete unused DHCP options sets in that region (EC2 console -> DHCP Options Sets)","If UnauthorizedOperation: grant ec2:CreateDhcpOptions and ec2:CreateTags to the kops IAM credentials","If InvalidParameterValue: correct the DomainName/DomainNameServers values in the cluster spec","Retry on throttling (RequestLimitExceeded) with backoff"],"exampleFix":"// before: kops IAM policy missing permission\n{\"Effect\": \"Deny\", \"Action\": [\"ec2:CreateDhcpOptions\"]}\n// after\n{\"Effect\": \"Allow\", \"Action\": [\"ec2:CreateDhcpOptions\", \"ec2:CreateTags\"], \"Resource\": \"*\"}","handlingStrategy":"validation","validationCode":"// Pre-flight before creating DHCP options\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"github.com/aws/aws-sdk-go-v2/service/ec2\"\n)\n\nfunc canCreateDhcpOptions(ctx context.Context, c *ec2.Client) error {\n\tif c.Options().Region == \"\" {\n\t\treturn fmt.Errorf(\"AWS region not set\")\n\t}\n\tif _, err := c.DescribeDhcpOptions(ctx, &ec2.DescribeDhcpOptionsInput{}); err != nil {\n\t\treturn fmt.Errorf(\"credentials cannot read EC2 (check perms/region): %w\", err)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"// Branch on the wrapped AWS error code\nif err := task.RenderAWS(target, a, e, changes); err != nil {\n\tif strings.Contains(err.Error(), \"LimitExceeded\") {\n\t\t// delete unused DHCP options sets, then retry\n\t} else if strings.Contains(err.Error(), \"UnauthorizedOperation\") {\n\t\t// fix IAM: ec2:CreateDhcpOptions\n\t}\n\treturn err\n}","preventionTips":["Grant ec2:CreateDhcpOptions and ec2:CreateTags to the kops IAM role before cluster create","Keep DHCP options set usage under the per-region quota; clean up unused sets","Validate domain-name-servers/domain-name values in the cluster spec before apply","Pin the AWS region explicitly to avoid endpoint errors","Use retry with backoff for RequestLimitExceeded throttling"],"tags":["aws","ec2","kops","dhcp-options","cluster-creation"],"backgroundTag":"aws-api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}