{"record":{"id":"2fd126b5cc9fd5f7","repo":"kubernetes/kops","slug":"error-describing-securitygroup-q-v","errorCode":null,"errorMessage":"error describing SecurityGroup %q: %v","messagePattern":"error describing SecurityGroup %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/securitygroup.go","lineNumber":50,"sourceCode":"\nfunc DeleteSecurityGroup(cloud fi.Cloud, t *resources.Resource) error {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\n\tid := t.ID\n\t// First clear all inter-dependent rules\n\t// TODO: Move to a \"pre-execute\" phase?\n\t{\n\t\trequest := &ec2.DescribeSecurityGroupsInput{\n\t\t\tGroupIds: []string{id},\n\t\t}\n\t\tresponse, err := c.EC2().DescribeSecurityGroups(ctx, request)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == \"InvalidGroup.NotFound\" {\n\t\t\t\tklog.V(2).Infof(\"Got InvalidGroup.NotFound error describing SecurityGroup %q; will treat as already-deleted\", id)\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error describing SecurityGroup %q: %v\", id, err)\n\t\t}\n\n\t\tif len(response.SecurityGroups) == 0 {\n\t\t\treturn nil\n\t\t}\n\t\tif len(response.SecurityGroups) != 1 {\n\t\t\treturn fmt.Errorf(\"found multiple SecurityGroups with ID %q\", id)\n\t\t}\n\n\t\truleReqest := &ec2.DescribeSecurityGroupRulesInput{\n\t\t\tFilters: []ec2types.Filter{\n\t\t\t\t{Name: aws.String(\"group-id\"), Values: []string{id}},\n\t\t\t},\n\t\t}\n\t\truleResp, err := c.EC2().DescribeSecurityGroupRules(ctx, ruleReqest)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == \"InvalidGroup.NotFound\" {\n\t\t\t\tklog.V(2).Infof(\"Got InvalidGroup.NotFound error describing rules for SecurityGroup %q; will treat as already-deleted\", id)","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/securitygroup.go#L32-L68","documentation":"In DeleteSecurityGroup (pkg/resources/aws/securitygroup.go:50), before deleting a security group the code describes it by ID to enumerate its rules. This error is returned when DescribeSecurityGroups fails with anything other than InvalidGroup.NotFound (which is treated as already-deleted). It means the pre-delete inspection of the SG failed.","triggerScenarios":"EC2 DescribeSecurityGroups with GroupIds=[id] returning errors other than InvalidGroup.NotFound: UnauthorizedOperation (missing ec2:DescribeSecurityGroups), InvalidGroup.NotFound variants not matched by AWSErrorCode, throttling, malformed group ID (ValidationException), or network errors.","commonSituations":"IAM role restricted to DescribeSecurityGroups on tags only, blocking ID-based lookup; stale resource tracker referencing an SG in another region/account; network outage mid-deletion; SG ID typo when manually invoking deletion tooling.","solutions":["Grant ec2:DescribeSecurityGroups in the deleting principal's IAM policy.","Verify the SG ID and that the client targets the same region/account as the SG.","If the group was already deleted, retry — InvalidGroup.NotFound is intentionally tolerated; other NotFound-shaped errors indicate SDK/error-code parsing issues.","Retry on transient throttling/network errors."],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"func isAlreadyDeleted(err error) bool {\n    return awsup.AWSErrorCode(err) == \"InvalidGroup.NotFound\"\n}","tryCatchPattern":"err := DeleteSecurityGroup(cloud, resource)\nvar apiErr smithy.APIError\nif errors.As(err, &apiErr) {\n    switch apiErr.ErrorCode() {\n    case \"InvalidGroup.NotFound\":\n        return nil // treat as deleted\n    case \"UnauthorizedOperation\":\n        return fmt.Errorf(\"check IAM ec2:DescribeSecurityGroups: %w\", err)\n    }\n}","preventionTips":["Grant ec2:DescribeSecurityGroups alongside delete permissions in automation roles.","Verify the SG belongs to the target region/account before deletion.","Check that error-code extraction handles SDK v2 error shapes.","Treat NotFound as idempotent success in idempotent delete loops."],"tags":["aws","ec2","security-group","describe"],"backgroundTag":"aws-api-describe-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}