{"record":{"id":"482d1b673bb0066c","repo":"kubernetes/kops","slug":"error-creating-vpc-v","errorCode":null,"errorMessage":"error creating VPC: %v","messagePattern":"error creating VPC: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpc.go","lineNumber":206,"sourceCode":"\t\t\t\tklog.Warningf(\"VPC did not have EnableDNSSupport=true, but ignoring because of VPCSkipEnableDNSSupport feature-flag\")\n\t\t\t} else {\n\t\t\t\t// TODO: We could easily just allow kops to fix this...\n\t\t\t\treturn fmt.Errorf(\"VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.\", fi.ValueOf(e.ID))\n\t\t\t}\n\t\t}\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating VPC with CIDR: %q\", *e.CIDR)\n\n\t\trequest := &ec2.CreateVpcInput{\n\t\t\tCidrBlock:         e.CIDR,\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVpc, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateVpc(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating VPC: %v\", err)\n\t\t}\n\n\t\te.ID = response.Vpc.VpcId\n\t}\n\n\tif changes.EnableDNSSupport != nil {\n\t\trequest := &ec2.ModifyVpcAttributeInput{\n\t\t\tVpcId:            e.ID,\n\t\t\tEnableDnsSupport: &ec2types.AttributeBooleanValue{Value: changes.EnableDNSSupport},\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().ModifyVpcAttribute(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error modifying VPC attribute: %v\", err)\n\t\t}\n\t}\n\n\tif changes.EnableDNSHostnames != nil {","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpc.go#L188-L224","documentation":"RenderAWS creates a new VPC via EC2 CreateVpc when no actual VPC exists; if that API call fails, the error is wrapped with this message. The task cannot proceed because the VPC is the foundation for subnets, gateways, etc.","triggerScenarios":"CreateVpc rejected: invalid/too-large CIDR overlapping an existing VPC, CIDR outside allowed ranges, VPC limit reached (default 5), throttling, or IAM lacking ec2:CreateVpc.","commonSituations":"CIDR collides with a peered VPC; account hit the VPC quota; typo in networkCIDR in cluster spec; corporate SCP forbidding CreateVpc.","solutions":["Check the wrapped AWS error: fix CIDR overlap or invalid range in cluster spec networkCIDR","Request a VPC quota increase or delete unused VPCs (error: VpcLimitExceeded)","Verify IAM permissions include ec2:CreateVpc (and CreateTags)","Retry if the cause was throttling (RequestLimitExceeded)"],"exampleFix":"// before: overlapping CIDR\nnetworkCIDR: 10.0.0.0/16   # overlaps existing VPC\n// after\nnetworkCIDR: 10.1.0.0/16","handlingStrategy":"try-catch","validationCode":"// check CIDR doesn't overlap existing VPCs and quota headroom\nvpcs, _ := ec2Client.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{})\nif len(vpcs.Vpcs) >= vpcQuota { return errors.New(\"VPC quota exhausted\") }","typeGuard":null,"tryCatchPattern":"err := kopsApply()\nvar ae smithy.APIError\nif errors.As(err, &ae) {\n\tswitch ae.ErrorCode() {\n\tcase \"VpcLimitExceeded\": requestQuotaIncrease()\n\tcase \"RequestLimitExceeded\": retryWithBackoff()\n\tcase \"InvalidVpcID.NotFound\", \"InvalidCidrBlock\": fixClusterSpecCIDR()\n\t}\n}","preventionTips":["Plan non-overlapping CIDRs across peered VPCs","Monitor VPC quota per region","Validate networkCIDR in `kops create` dry-runs","Ensure SCPs permit ec2:CreateVpc"],"tags":["aws","ec2","vpc","quota","cidr"],"backgroundTag":"aws-vpc-creation-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}