{"record":{"id":"2e4b36f3de5e68b8","repo":"cilium/cilium","slug":"cannot-parse-aws-managed-prefix-list-entry-w","errorCode":null,"errorMessage":"cannot parse aws managed prefix list entry: %w","messagePattern":"cannot parse aws managed prefix list entry: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/groups/aws/aws.go","lineNumber":231,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"cannot retrieve aws managed prefix list information: %w\", err)\n\t\t}\n\n\t\tfor _, plist := range output.PrefixLists {\n\t\t\tinput := &ec2.GetManagedPrefixListEntriesInput{\n\t\t\t\tPrefixListId: plist.PrefixListId,\n\t\t\t}\n\n\t\t\tpaginator := ec2.NewGetManagedPrefixListEntriesPaginator(ec2Client, input)\n\t\t\tfor paginator.HasMorePages() {\n\t\t\t\toutput, err := paginator.NextPage(ctx)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"cannot retrieve aws managed prefix list entries: %w\", err)\n\t\t\t\t}\n\n\t\t\t\tfor _, entry := range output.Entries {\n\t\t\t\t\taddr, err := netip.ParsePrefix(aws.ToString(entry.Cidr))\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"cannot parse aws managed prefix list entry: %w\", err)\n\t\t\t\t\t}\n\n\t\t\t\t\tresult = append(result, addr)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn result, nil\n}\n","sourceCodeStart":213,"sourceCodeEnd":242,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/groups/aws/aws.go#L213-L242","documentation":"Each entry returned by GetManagedPrefixListEntries contains a Cidr string that is parsed with netip.ParsePrefix; if the string is not a valid CIDR prefix the error is wrapped as 'cannot parse aws managed prefix list entry'. This guards against malformed data coming back from the AWS API.","triggerScenarios":"An entry's Cidr field is empty (aws.ToString on a nil value) or not in CIDR notation (e.g. missing prefix length), typically due to an unexpected API response or an entry type that is not a CIDR.","commonSituations":"AWS API behavior changes or SDK version mismatches producing nil Cidr, corrupted local prefix lists, or code paths assuming all entries are CIDRs when some are resources.","solutions":["Log the raw entry.Cidr value to see what AWS returned","Skip/ignore non-CIDR entries instead of failing the whole resolution, if appropriate for your policy","Update the AWS SDK / Cilium to a version handling these entry types","If Cidr is empty, verify the prefix list contents in the AWS console"],"exampleFix":"// before\naddr, err := netip.ParsePrefix(aws.ToString(entry.Cidr))\nif err != nil {\n    return nil, fmt.Errorf(\"cannot parse aws managed prefix list entry: %w\", err)\n}\n// after\ncidr := aws.ToString(entry.Cidr)\naddr, err := netip.ParsePrefix(cidr)\nif err != nil {\n    p.log.Warn(\"skipping malformed prefix list entry\", \"cidr\", cidr, \"err\", err)\n    continue\n}\n","handlingStrategy":"type-guard","validationCode":"// sanity-check CIDR strings you expect back from AWS\nfor _, e := range entries {\n    cidr := aws.ToString(e.Cidr)\n    if cidr == \"\" || !strings.Contains(cidr, \"/\") {\n        log.Printf(\"skipping non-CIDR prefix list entry: %q\", cidr)\n    }\n}","typeGuard":"func isCIDR(s string) bool {\n    _, err := netip.ParsePrefix(s)\n    return err == nil\n}\n\n// usage: if !isCIDR(aws.ToString(entry.Cidr)) { skip }","tryCatchPattern":"_, err := netip.ParsePrefix(cidr)\nif err != nil {\n    log.Printf(\"malformed prefix list entry %q: %v — skipping\", cidr, err)\n    return nil // continue instead of failing group resolution\n}","preventionTips":["Never assume entry.Cidr is non-nil; always aws.ToString and check emptiness","Pin and update the AWS SDK so entry structures match current AWS API responses","Audit prefix lists in the AWS console if parse errors appear (corrupt entries)","Prefer skip-and-log over hard-fail when one malformed entry should not break group resolution"],"tags":["aws","prefix-list","cidr","parsing","cilium"],"backgroundTag":"cidr-parse-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}