{"record":{"id":"3315ded76d2034de","repo":"kubernetes/kops","slug":"found-multiple-internetgateways-with-id-q","errorCode":null,"errorMessage":"found multiple InternetGateways with id %q","messagePattern":"found multiple InternetGateways with id %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":1021,"sourceCode":"\tvar igw *ec2types.InternetGateway\n\t{\n\t\trequest := &ec2.DescribeInternetGatewaysInput{\n\t\t\tInternetGatewayIds: []string{id},\n\t\t}\n\t\tresponse, err := c.EC2().DescribeInternetGateways(ctx, request)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == \"InvalidInternetGatewayID.NotFound\" {\n\t\t\t\tklog.Infof(\"Internet gateway %q not found; assuming already deleted\", id)\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\treturn fmt.Errorf(\"error describing InternetGateway %q: %v\", id, err)\n\t\t}\n\t\tif response == nil || len(response.InternetGateways) == 0 {\n\t\t\treturn nil\n\t\t}\n\t\tif len(response.InternetGateways) != 1 {\n\t\t\treturn fmt.Errorf(\"found multiple InternetGateways with id %q\", id)\n\t\t}\n\t\tigw = &response.InternetGateways[0]\n\t}\n\n\tfor _, a := range igw.Attachments {\n\t\tklog.V(2).Infof(\"Detaching EC2 InternetGateway %q\", id)\n\t\trequest := &ec2.DetachInternetGatewayInput{\n\t\t\tInternetGatewayId: &id,\n\t\t\tVpcId:             a.VpcId,\n\t\t}\n\t\t_, err := c.EC2().DetachInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\tif IsDependencyViolation(err) {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error detaching InternetGateway %q: %v\", id, err)\n\t\t}\n\t}","sourceCodeStart":1003,"sourceCodeEnd":1039,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L1003-L1039","documentation":"kOps raises this when DescribeInternetGateways returns more than one InternetGateway matching the given ID, which should be impossible in AWS (IDs are unique). It is a defensive sanity check before using the single result. Hitting it indicates an API/SDK-level anomaly or a mock/test setup returning duplicated entries.","triggerScenarios":"The DescribeInternetGateways response for a single IGW ID contains len(InternetGateways) != 1 — i.e., 2 or more entries were returned for one ID.","commonSituations":"Bugs in test doubles or mocked EC2 implementations; SDK/API paging anomalies; running against an API-compatible (e.g., on-prem/AWS-emulating) endpoint that misbehaves.","solutions":["Inspect the actual AWS account: `aws ec2 describe-internet-gateways --internet-gateway-ids <id>` — a real account should return exactly one","If using a mock/EC2-compatible endpoint, fix its describe implementation to return unique entries","Retry the kOps delete against real AWS; this is virtually always environmental","File an issue with kOps if reproducible against real AWS"],"exampleFix":"// defensive handling in caller\nif strings.Contains(err.Error(), \"found multiple InternetGateways\") {\n\tigws, _ := aws.DescribeInternetGateways(cloud)\n\t// pick the gateway whose InternetGatewayId == id\n}","handlingStrategy":"type-guard","validationCode":"// verify uniqueness against real AWS before proceeding\nout, err := c.EC2().DescribeInternetGateways(ctx, &ec2.DescribeInternetGatewaysInput{\n\tInternetGatewayIds: []string{id},\n})\nif err != nil { return err }\nif len(out.InternetGateways) != 1 {\n\treturn fmt.Errorf(\"expected exactly 1 IGW for %s, got %d\", id, len(out.InternetGateways))\n}","typeGuard":"func singleIGW(out *ec2.DescribeInternetGatewaysOutput) *ec2types.InternetGateway {\n\tif out == nil || len(out.InternetGateways) != 1 {\n\t\treturn nil\n\t}\n\treturn &out.InternetGateways[0]\n}","tryCatchPattern":"if err != nil {\n\tif strings.Contains(err.Error(), \"found multiple InternetGateways\") {\n\t\t// fall back to re-describing and matching by exact ID\n\t\tigws, derr := aws.DescribeInternetGateways(cloud)\n\t\tif derr != nil { return derr }\n\t\tfor _, g := range igws { if aws.ToString(g.InternetGatewayId) == id { /* proceed */ } }\n\t}\n\treturn err\n}","preventionTips":["If using mocked EC2 endpoints, ensure describe results contain unique IDs","Re-describe by ID to disambiguate instead of failing the whole deletion","Report to kOps/AWS if reproducible against real AWS — IDs are globally unique"],"tags":["aws","ec2","internet-gateway","invariant-violation"],"backgroundTag":"aws-invariant-violation","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}