{"record":{"id":"40b49cfe3781839f","repo":"kubernetes/kops","slug":"error-creating-nat-gateway-v","errorCode":null,"errorMessage":"Error creating Nat Gateway: %v","messagePattern":"Error creating Nat Gateway: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":321,"sourceCode":"\tctx := context.TODO()\n\n\tvar id *string\n\tif a == nil {\n\n\t\tif fi.ValueOf(e.Shared) {\n\t\t\treturn fmt.Errorf(\"NAT gateway %q not found\", fi.ValueOf(e.ID))\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating Nat Gateway\")\n\n\t\trequest := &ec2.CreateNatGatewayInput{\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeNatgateway, e.Tags),\n\t\t}\n\t\trequest.AllocationId = e.ElasticIP.ID\n\t\trequest.SubnetId = e.Subnet.ID\n\t\tresponse, err := t.Cloud.EC2().CreateNatGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error creating Nat Gateway: %v\", err)\n\t\t}\n\t\te.ID = response.NatGateway.NatGatewayId\n\t\tid = e.ID\n\t} else {\n\t\tid = a.ID\n\t}\n\n\terr := t.AddAWSTags(*e.ID, e.Tags)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to tag NatGateway\")\n\t}\n\n\t// Tag the associated subnet\n\tif e.Subnet == nil {\n\t\treturn fmt.Errorf(\"Subnet not set\")\n\t} else if e.Subnet.ID == nil {\n\t\treturn fmt.Errorf(\"Subnet ID not set\")\n\t}","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L303-L339","documentation":"The EC2 CreateNatGateway API call failed during RenderAWS, so the new NAT gateway could not be provisioned. The AWS error is wrapped verbatim; common AWS causes are no free Elastic IP allocation, subnet issues, or throttling.","triggerScenarios":"t.Cloud.EC2().CreateNatGateway returns err — InsufficientFreeAddressesInSubnet, ElasticIP allocation problems, InvalidSubnetID.NotFound, CreateNatGateway rate limit (one per subnet per ~30s), or AccessDenied.","commonSituations":"Private subnet exhausted its free IPs; creating many private subnets at once (AWS throttles NAT gateway creation per subnet); ElasticIP task referenced an allocation in the wrong region; IAM missing ec2:CreateNatGateway.","solutions":["Read the wrapped AWS cause: for InsufficientFreeAddressesInSubnet, enlarge the subnet CIDR or free up IPs","For rate limiting, wait ~30s+ and re-run `kops update cluster` (kops will retry creation)","Verify the ElasticIP allocation exists in the same region and subnet ID is correct","Ensure IAM allows ec2:CreateNatGateway and ec2:CreateTags"],"exampleFix":"// before: too-small private subnet\n# cluster spec: cidr: 172.20.1.0/28  (no free IPs)\n// after\n# cluster spec: cidr: 172.20.1.0/24","handlingStrategy":"try-catch","validationCode":"subnet, err := ec2Client.DescribeSubnets(ctx, &ec2.DescribeSubnetsInput{SubnetIds: []string{subnetID}})\n// check free address count\navailIPs := *subnet.Subnets[0].AvailableIpAddressCount\nif availIPs < 8 { return fmt.Errorf(\"subnet %s has only %d free IPs\", subnetID, availIPs) }","typeGuard":null,"tryCatchPattern":"err := applyCluster(ctx)\nvar aerr smithy.APIError\nif errors.As(err, &aerr) {\n  switch aerr.ErrorCode() {\n  case \"InsufficientFreeAddressesInSubnet\": // enlarge subnet CIDR\n  case \"Throttling\", \"LimitExceededException\": // backoff, NATGW creation is rate-limited per subnet\n  case \"InvalidSubnetID.NotFound\": // fix subnet id / region\n  }\n}","preventionTips":["Give private subnets ample CIDR space (/24 recommended)","Ensure the Elastic IP allocation is in the same region as the subnet","Space out creation of many private subnets to avoid per-subnet NATGW rate limits","Include ec2:CreateNatGateway in the IAM policy"],"tags":["aws","ec2","natgateway","provisioning"],"backgroundTag":"aws-resource-creation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}