{"record":{"id":"48b2fb94d7bc7d69","repo":"kubernetes/kops","slug":"error-listing-subnets-in-vpc-q-v","errorCode":null,"errorMessage":"error listing subnets in VPC %q: %v","messagePattern":"error listing subnets in VPC %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":1917,"sourceCode":"\t}\n\tif vpc == nil {\n\t\treturn nil, nil\n\t}\n\n\tvpcInfo := &fi.VPCInfo{\n\t\tCIDR: aws.ToString(vpc.CidrBlock),\n\t}\n\n\t// Find subnets in the VPC\n\t{\n\t\tklog.V(2).Infof(\"Calling DescribeSubnets for subnets in VPC %q\", vpcID)\n\t\trequest := &ec2.DescribeSubnetsInput{\n\t\t\tFilters: []ec2types.Filter{NewEC2Filter(\"vpc-id\", vpcID)},\n\t\t}\n\n\t\tresponse, err := c.EC2().DescribeSubnets(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing subnets in VPC %q: %v\", vpcID, err)\n\t\t}\n\t\tif response != nil {\n\t\t\tfor _, subnet := range response.Subnets {\n\t\t\t\tsubnetInfo := &fi.SubnetInfo{\n\t\t\t\t\tID:   aws.ToString(subnet.SubnetId),\n\t\t\t\t\tCIDR: aws.ToString(subnet.CidrBlock),\n\t\t\t\t\tZone: aws.ToString(subnet.AvailabilityZone),\n\t\t\t\t}\n\n\t\t\t\tvpcInfo.Subnets = append(vpcInfo.Subnets, subnetInfo)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn vpcInfo, nil\n}\n\nfunc (c *awsCloudImplementation) GetApiIngressStatus(cluster *kops.Cluster) ([]fi.ApiIngressStatus, error) {","sourceCodeStart":1899,"sourceCodeEnd":1935,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L1899-L1935","documentation":"Returned by DescribeSubnets (aws_cloud.go:1917) when ec2.DescribeSubnets filtered by vpc-id fails while kops enumerates subnets in the VPC to populate subnet info (IDs and CIDRs). The AWS error is embedded in the message.","triggerScenarios":"DescribeSubnets with Filter vpc-id=<vpcID> errors: missing ec2:DescribeSubnets IAM permission, invalid VPC ID, throttling, credentials/region problems, or network failure to the EC2 endpoint.","commonSituations":"IAM read-only policies omitting DescribeSubnets; VPC shared from another account (RAM) with limited visibility; transient throttling during parallel operations; VPC ID typo'd in the cluster spec.","solutions":["Check the wrapped AWS message: AccessDenied → add ec2:DescribeSubnets to the policy; Throttling → retry with backoff","Reproduce manually: `aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpcID> --region <region>`","Verify credentials/region match the account that owns (or is granted access to) the VPC","For shared VPCs, ensure the caller account has EC2 describe permissions via RAM sharing"],"exampleFix":"// before\n# AccessDenied: ec2:DescribeSubnets\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:DescribeSubnets\",\"ec2:DescribeVpcs\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// Pre-flight: confirm subnets in the VPC are describable\nout, err := ec2Client.DescribeSubnets(ctx, &ec2.DescribeSubnetsInput{\n\tFilters: []ec2types.Filter{ec2filter(\"vpc-id\", vpcID)},\n})\nif err != nil { return fmt.Errorf(\"cannot list subnets in %s: %w\", vpcID, err) }","typeGuard":null,"tryCatchPattern":"subnets, err := cloud.DescribeSubnets(ctx, vpcID)\nif err != nil {\n\tif strings.Contains(err.Error(), \"UnauthorizedOperation\") { /* fix IAM then retry */ }\n\tif strings.Contains(err.Error(), \"Throttling\") { /* backoff then retry */ }\n\treturn err\n}","preventionTips":["Grant ec2:DescribeSubnets (and DescribeVpcs) to the automation role","For RAM-shared VPCs, confirm cross-account describe permissions","Serialize large batch operations to avoid EC2 throttling","Validate the VPC ID format before calls that filter on it"],"tags":["aws","ec2","subnet","iam","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}