{"record":{"id":"4b5ee4772c178d4f","repo":"kubernetes/kops","slug":"error-associating-amazon-ipv6-provided-cidr-block","errorCode":null,"errorMessage":"error associating Amazon IPv6 provided CIDR block to VPC: %v","messagePattern":"error associating Amazon IPv6 provided CIDR block to VPC: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpcamazonipv6cidrblock.go","lineNumber":105,"sourceCode":"\nfunc (_ *VPCAmazonIPv6CIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {\n\tctx := context.TODO()\n\tshared := aws.ToBool(e.Shared)\n\tif shared && a == nil {\n\t\t// VPC not owned by kOps, no changes will be applied\n\t\t// Verify that the Amazon IPv6 provided CIDR block was found.\n\t\treturn fmt.Errorf(\"IPv6 CIDR block provided by Amazon not found\")\n\t}\n\n\trequest := &ec2.AssociateVpcCidrBlockInput{\n\t\tVpcId:                       e.VPC.ID,\n\t\tAmazonProvidedIpv6CidrBlock: aws.Bool(true),\n\t}\n\n\t// Response doesn't contain the new CIDR block\n\t_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error associating Amazon IPv6 provided CIDR block to VPC: %v\", err)\n\t}\n\n\treturn nil // no tags\n}\n\nfunc (_ *VPCAmazonIPv6CIDRBlock) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {\n\t// At the moment, this can only be done via the aws_vpc resource\n\treturn nil\n}\n\nfunc findVPCIPv6CIDR(cloud awsup.AWSCloud, vpcID *string) (*string, error) {\n\tvpc, err := cloud.DescribeVPC(aws.ToString(vpcID))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar byoIPv6CidrBlock *string\n","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpcamazonipv6cidrblock.go#L87-L123","documentation":"Wraps any failure from the EC2 AssociateVpcCidrBlock call that associates the Amazon-provided IPv6 /56 CIDR block (AmazonProvidedIpv6CidrBlock=true) with the kOps-managed VPC. RenderAWS performs this mutation because the VPC exists but does not yet have the Amazon-provided IPv6 pool associated. The error is a pass-through of the underlying AWS SDK error.","triggerScenarios":"RenderAWS of VPCAmazonIPv6CIDRBlock invokes t.Cloud.EC2().AssociateVpcCidrBlock with AmazonProvidedIpv6CidrBlock=true and the SDK returns any error (permission denied, VPC limit, wrong state).","commonSituations":"EC2 IAM policy lacks ec2:AssociateVpcCidrBlock; VPC already has the maximum number of CIDR associations; VPC is shared (RAM) and not owned by the account; the VPC was deleted concurrently.","solutions":["Ensure the IAM policy for the kOps controller/user includes ec2:AssociateVpcCidrBlock","Check the VPC doesn't already have an Amazon-provided IPv6 CIDR (reconcile state: kops replace/update cluster)","Verify the VPC is owned by the account, not shared via RAM, and is in 'available' state","Read the wrapped %v AWS SDK error for the specific cause (e.g. InvalidVpcState, UnauthorizedOperation)"],"exampleFix":"// before\n_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)\n// after (region-level fix: grant permission / retry on InvalidVpcState)\nif awsup.AWSErrorCode(err) == \"InvalidVpcState\" {\n\treturn fi.NewTryAgainLaterError(\"waiting for VPC to become available\").WithError(err)\n}","handlingStrategy":"validation","validationCode":"// before apply, confirm permission and VPC state\nif !iamAllows(\"ec2:AssociateVpcCidrBlock\") { return errors.New(\"IAM policy missing ec2:AssociateVpcCidrBlock\") }\nvpc, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})\nif *vpc.Vpcs[0].State != \"available\" { return errors.New(\"VPC not available\") }","typeGuard":null,"tryCatchPattern":"if err != nil {\n\tif awsup.AWSErrorCode(err) == \"InvalidVpcState\" || awsup.AWSErrorCode(err) == \"Throttling\" {\n\t\treturn fi.NewTryAgainLaterError(\"retrying VPC IPv6 association\").WithError(err)\n\t}\n\treturn fmt.Errorf(\"error associating Amazon IPv6 provided CIDR block to VPC: %v\", err)\n}","preventionTips":["Pre-provision VPC with AmazonProvidedIpv6CidrBlock already set so kOps doesn't need to mutate it","Include ec2:AssociateVpcCidrBlock in the IAM policy used by kOps","Don't use RAM-shared VPCs owned by other accounts for IPv6 association","Check VPC CIDR association limits before adding IPv6"],"tags":["aws","ec2","ipv6","vpc","cidr"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}