{"record":{"id":"37b959398f78d7a0","repo":"kubernetes/kops","slug":"listing-elb-tags-w","errorCode":null,"errorMessage":"listing ELB tags: %w","messagePattern":"listing ELB tags: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/elbv2_loadbalancers.go","lineNumber":89,"sourceCode":"\t\t}\n\t\tif len(page.LoadBalancers) == 0 {\n\t\t\tbreak\n\t\t}\n\n\t\ttagRequest := &elbv2.DescribeTagsInput{}\n\n\t\tfor _, elb := range page.LoadBalancers {\n\t\t\tarn := aws.ToString(elb.LoadBalancerArn)\n\t\t\tbyARN[arn] = &LoadBalancerInfo{LoadBalancer: elb, arn: arn}\n\n\t\t\t// TODO: Any way to filter by cluster here?\n\n\t\t\ttagRequest.ResourceArns = append(tagRequest.ResourceArns, aws.ToString(elb.LoadBalancerArn))\n\t\t}\n\n\t\ttagResponse, err := cloud.ELBV2().DescribeTags(ctx, tagRequest)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"listing ELB tags: %w\", err)\n\t\t}\n\n\t\tfor _, t := range tagResponse.TagDescriptions {\n\t\t\tarn := aws.ToString(t.ResourceArn)\n\n\t\t\tinfo := byARN[arn]\n\t\t\tif info == nil {\n\t\t\t\tklog.Fatalf(\"found tag for load balancer we didn't ask for %q\", arn)\n\t\t\t}\n\n\t\t\tinfo.Tags = append(info.Tags, t.Tags...)\n\t\t}\n\t}\n\n\tcloudTags := cloud.Tags()\n\n\tvar results []*LoadBalancerInfo\n\tfor _, v := range byARN {","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/elbv2_loadbalancers.go#L71-L107","documentation":"Within ListELBV2LoadBalancers, after collecting load balancer ARNs on each page, the code calls ELBV2 DescribeTags to fetch tags. Failure of that call is wrapped with this message. Note tags for a page are requested in a single batched DescribeTags call.","triggerScenarios":"DescribeTags fails for the batched load balancer ARNs: IAM permission missing for elasticloadbalancing:DescribeTags, throttling when many pages are listed, ARNs revoked/deleted between list and tag calls, or API/network errors.","commonSituations":"Least-privilege IAM policies that grant DescribeLoadBalancers but not DescribeTags; large accounts with many load balancers hitting DescribeTags rate limits; load balancers deleted concurrently by other automation.","solutions":["Grant elasticloadbalancing:DescribeTags in the IAM policy of the kOps principal.","Handle throttling with retry/backoff; the AWS SDK retryer may need increased max attempts.","Inspect the wrapped error via errors.As for the specific AWS error code.","Re-run the listing; transient failures or concurrently deleted LBs usually clear."],"exampleFix":"// before (IAM policy)\n{\"Action\":[\"elasticloadbalancing:DescribeLoadBalancers\"]}\n// after\n{\"Action\":[\"elasticloadbalancing:DescribeLoadBalancers\",\"elasticloadbalancing:DescribeTags\"]}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"_, err := cloud.ListELBV2LoadBalancers()\nif err != nil {\n\tvar ae smithy.APIError\n\tif errors.As(err, &ae) && ae.ErrorCode() == \"AccessDenied\" {\n\t\t// surface IAM guidance: add elasticloadbalancing:DescribeTags\n\t}\n\treturn err\n}","preventionTips":["Always pair elasticloadbalancing:DescribeLoadBalancers with DescribeTags in IAM policies","Watch for throttling on large accounts; batch/list during off-peak or reduce frequency","Handle concurrent deletions by treating transient failures as retryable"],"tags":["aws","elbv2","iam","tags"],"backgroundTag":"aws-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}