{"record":{"id":"34fd25887dfa31cc","repo":"kubernetes/kops","slug":"error-listing-tags-v-34fd25","errorCode":null,"errorMessage":"error listing tags: %v","messagePattern":"error listing tags: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":165,"sourceCode":"\n\t// Find via tag on subnet\n\t// TODO: Obsolete - we can get from the route table instead\n\tif id == nil && e.Subnet != nil {\n\t\tvar filters []ec2types.Filter\n\t\tfilters = append(filters, awsup.NewEC2Filter(\"key\", \"AssociatedNatgateway\"))\n\t\tif e.Subnet.ID == nil {\n\t\t\tklog.V(2).Infof(\"Unable to find subnet, bypassing Find() for NatGateway\")\n\t\t\treturn nil, nil\n\t\t}\n\t\tfilters = append(filters, awsup.NewEC2Filter(\"resource-id\", *e.Subnet.ID))\n\n\t\trequest := &ec2.DescribeTagsInput{\n\t\t\tFilters: filters,\n\t\t}\n\n\t\tresponse, err := cloud.EC2().DescribeTags(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing tags: %v\", err)\n\t\t}\n\n\t\tif response == nil || len(response.Tags) == 0 {\n\t\t\treturn nil, nil\n\t\t}\n\n\t\tif len(response.Tags) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found multiple tags for: %v\", e)\n\t\t}\n\t\tt := response.Tags[0]\n\t\tid = t.Value\n\t\tklog.V(2).Infof(\"Found NatGateway via subnet tag: %v\", *id)\n\t}\n\n\tif id != nil {\n\t\treturn findNatGatewayById(ctx, cloud, fi.ValueOf(id))\n\t}\n","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L147-L183","documentation":"findNatGateway (the default discovery path when no ID is set) calls ec2:DescribeTags with filters (e.g. tag kubernetes.io/cluster/<name>, resource-type natgateway) to locate the cluster's NAT gateway, and wraps any DescribeTags error with this message. Discovery fails so the task cannot compute actual state.","triggerScenarios":"DescribeTags returns an error: AccessDenied on ec2:DescribeTags, API throttling, invalid filter ARN/values, or transient network failure.","commonSituations":"IAM policy lacking ec2:DescribeTags, throttling on clusters with many tagged resources, filter mismatches after cluster rename (though those yield empty results, not this error).","solutions":["Check the wrapped error for the exact AWS code","Grant ec2:DescribeTags to the kOps IAM role","Retry on throttling errors","Validate filters/region configuration if InvalidFilter errors appear"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure permission & filters before discovery\n_, err := cloud.EC2().DescribeTags(ctx, &ec2.DescribeTagsInput{Filters: filters, MaxResults: aws.Int32(5)})\nif err != nil { /* surface permission/region problem early */ }","typeGuard":null,"tryCatchPattern":"response, err := cloud.EC2().DescribeTags(ctx, request)\nif err != nil {\n  var re *awshttp.ResponseError\n  if errors.As(err, &re) && isThrottling(re) { backoff(); continue }\n  return nil, fmt.Errorf(\"error listing tags: %w\", err)\n}","preventionTips":["Grant ec2:DescribeTags to the kOps IAM role","Add backoff for DescribeTags which is commonly throttled","Keep kubernetes.io/cluster/<name> tags intact on NAT gateways","Verify region configuration before discovery"],"tags":["aws","ec2","nat-gateway","tags","discovery"],"backgroundTag":"aws-api-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}