{"record":{"id":"323558cef4e1d425","repo":"kubernetes/kops","slug":"error-listing-enis-v","errorCode":null,"errorMessage":"error listing ENIs: %v","messagePattern":"error listing ENIs: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/eni.go","lineNumber":89,"sourceCode":"\t\treturn nil, nil\n\t}\n\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\n\tvpcFilter := awsup.NewEC2Filter(\"vpc-id\", vpcID)\n\tstatusFilter := awsup.NewEC2Filter(\"status\", string(ec2types.NetworkInterfaceStatusAvailable))\n\tenis := make(map[string]ec2types.NetworkInterface)\n\tklog.V(2).Info(\"Listing ENIs\")\n\tfor _, filters := range buildEC2FiltersForCluster(clusterName) {\n\t\trequest := &ec2.DescribeNetworkInterfacesInput{\n\t\t\tFilters: append(filters, vpcFilter, statusFilter),\n\t\t}\n\t\tpaginator := ec2.NewDescribeNetworkInterfacesPaginator(c.EC2(), request)\n\t\tfor paginator.HasMorePages() {\n\t\t\tdnio, err := paginator.NextPage(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error listing ENIs: %v\", err)\n\t\t\t}\n\t\t\tfor _, eni := range dnio.NetworkInterfaces {\n\t\t\t\tenis[aws.ToString(eni.NetworkInterfaceId)] = eni\n\t\t\t}\n\t\t}\n\t}\n\n\treturn enis, nil\n}\n\nfunc ListENIs(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\tenis, err := DescribeENIs(cloud, vpcID, clusterName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\tfor _, v := range enis {","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/eni.go#L71-L107","documentation":"kOps wraps the AWS SDK error from ec2 DescribeNetworkInterfaces pagination while listing ENIs in the cluster VPC for cleanup. Any page failure aborts the entire ENI listing, so dependent resource cleanup cannot proceed. The cause is in the wrapped err.","triggerScenarios":"DescribeNetworkInterfaces fails during pagination: throttling (RequestLimitExceeded), missing ec2:DescribeNetworkInterfaces permission, invalid filter values (e.g. bad vpc-id), or network errors on large accounts with many pages.","commonSituations":"Large AWS accounts with thousands of ENIs hitting EC2 rate limits; restricted read-only IAM policies used for `kops delete cluster --dry-run`; specifying a wrong VPC id filter upstream.","solutions":["Run `aws ec2 describe-network-interfaces --filters name=vpc-id,values=<vpc>` to reproduce","If RequestLimitExceeded, reduce parallel API usage or increase retries/backoff","Add ec2:DescribeNetworkInterfaces to the caller's policy if AccessDenied","Verify the VPC id filter inputs are correct"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight: verify describe permission and VPC id format\nif !strings.HasPrefix(vpcID, \"vpc-\") { return fmt.Errorf(\"invalid vpc id %q\", vpcID) }\n_, err := ec2Client.DescribeNetworkInterfaces(ctx, &ec2.DescribeNetworkInterfacesInput{\n  Filters: []types.Filter{{Name: aws.String(\"vpc-id\"), Values: []string{vpcID}}}, MaxResults: aws.Int32(5),\n})","typeGuard":"func isEC2Throttled(err error) bool {\n  code := awsup.AWSErrorCode(err)\n  return code == \"RequestLimitExceeded\" || code == \"ThrottlingException\" || code == \"TooManyRequests\"\n}","tryCatchPattern":"enis, err := ListENIs(cloud, vpcID)\nif err != nil {\n  if isEC2Throttled(err) { /* exponential backoff, then retry */ }\n  return fmt.Errorf(\"cannot enumerate ENIs for cleanup: %w\", err)\n}","preventionTips":["Reduce parallel EC2 API consumers during cluster teardown","Grant ec2:DescribeNetworkInterfaces to the operator role","Throttle page size/pagination on very large accounts","Verify VPC id inputs before listing"],"tags":["aws","ec2","eni","pagination"],"backgroundTag":"aws-ec2-describe-throttled","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}