{"record":{"id":"4c7df3dee44448b0","repo":"kubernetes/kops","slug":"nexttoken-set-from-describenatgateways-but-pagina","errorCode":null,"errorMessage":"NextToken set from DescribeNatGateways, but pagination not implemented","messagePattern":"NextToken set from DescribeNatGateways, but pagination not implemented","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":1396,"sourceCode":"\t\t}\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\tfor natGatewayId := range natGatewayIds {\n\t\trequest := &ec2.DescribeNatGatewaysInput{\n\t\t\tNatGatewayIds: []string{natGatewayId},\n\t\t}\n\t\tresponse, err := c.EC2().DescribeNatGateways(ctx, request)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == \"NatGatewayNotFound\" {\n\t\t\t\tklog.V(2).Infof(\"Got NatGatewayNotFound describing NatGateway %s; will treat as already-deleted\", natGatewayId)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"error from DescribeNatGateways: %v\", err)\n\t\t}\n\n\t\tif response.NextToken != nil {\n\t\t\treturn nil, fmt.Errorf(\"NextToken set from DescribeNatGateways, but pagination not implemented\")\n\t\t}\n\n\t\tfor _, ngw := range response.NatGateways {\n\t\t\tnatGatewayId := aws.ToString(ngw.NatGatewayId)\n\n\t\t\tforceShared := !ownedNatGatewayIds.Has(natGatewayId)\n\t\t\tngwResource := buildNatGatewayResource(ngw, forceShared, clusterName)\n\t\t\tresourceTrackers = append(resourceTrackers, ngwResource)\n\n\t\t\t// Don't try to remove ElasticIPs if NatGateway is shared\n\t\t\tif ngwResource.Shared {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\t// If we're deleting the NatGateway, we should delete the ElasticIP also\n\t\t\tfor _, address := range ngw.NatGatewayAddresses {\n\t\t\t\tif address.AllocationId != nil {\n\t\t\t\t\trequest := &ec2.DescribeAddressesInput{}","sourceCodeStart":1378,"sourceCodeEnd":1414,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L1378-L1414","documentation":"kops' FindNatGateways calls DescribeNatGateways without pagination support; if AWS returns a NextToken (result set larger than one page), it deliberately fails fast rather than silently dropping NAT gateways. This is a defensive limitation error, not an AWS failure.","triggerScenarios":"DescribeNatGateways response contains a non-nil NextToken — i.e., more NAT gateways match the filter than fit in a single API page.","commonSituations":"Enumerating resources in an account/region with many NAT gateways (many large multi-cluster setups) sharing the same VPC filters.","solutions":["Upgrade kops to a version where DescribeNatGateways pagination is implemented.","Work around by reducing matching NAT gateways (filters on the cluster's VPC only) or running per-VPC.","Patch locally: convert to ec2.NewDescribeNatGatewaysPaginator and iterate pages like DescribeLaunchTemplates does."],"exampleFix":"// before\nresponse, err := c.EC2().DescribeNatGateways(ctx, request)\nif response.NextToken != nil {\n\treturn nil, fmt.Errorf(\"NextToken set from DescribeNatGateways, but pagination not implemented\")\n}\n// after\npaginator := ec2.NewDescribeNatGatewaysPaginator(c.EC2(), request)\nfor paginator.HasMorePages() {\n\tpage, err := paginator.NextPage(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error from DescribeNatGateways: %w\", err)\n\t}\n\t// process page.NatGateways\n}","handlingStrategy":"validation","validationCode":"if len(natGatewayIDs) > 50 { /* page manually or split into batches — large sets can return NextToken */ }","typeGuard":"func nextTokenSet(resp *ec2.DescribeNatGatewaysOutput) bool { return resp != nil && resp.NextToken != nil }","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"pagination not implemented\") {\n\t// fall back to per-ID DescribeNatGateways calls which never paginate\n\treturn listNatGatewaysOneByOne(ids)\n}","preventionTips":["Use a kops version with paginator-based DescribeNatGateways","For accounts with many NAT gateways, enumerate per-VPC or per-ID","When patching, mirror ec2.NewDescribeLaunchTemplatesPaginator usage"],"tags":["aws","ec2","nat-gateway","pagination"],"backgroundTag":"pagination-not-implemented","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}