{"record":{"id":"5d6f33fe9a8d1669","repo":"kubernetes/kops","slug":"error-modifying-vpc-attribute-v","errorCode":null,"errorMessage":"error modifying VPC attribute: %v","messagePattern":"error modifying VPC attribute: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpc.go","lineNumber":220,"sourceCode":"\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateVpc(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating VPC: %v\", err)\n\t\t}\n\n\t\te.ID = response.Vpc.VpcId\n\t}\n\n\tif changes.EnableDNSSupport != nil {\n\t\trequest := &ec2.ModifyVpcAttributeInput{\n\t\t\tVpcId:            e.ID,\n\t\t\tEnableDnsSupport: &ec2types.AttributeBooleanValue{Value: changes.EnableDNSSupport},\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().ModifyVpcAttribute(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error modifying VPC attribute: %v\", err)\n\t\t}\n\t}\n\n\tif changes.EnableDNSHostnames != nil {\n\t\trequest := &ec2.ModifyVpcAttributeInput{\n\t\t\tVpcId:              e.ID,\n\t\t\tEnableDnsHostnames: &ec2types.AttributeBooleanValue{Value: changes.EnableDNSHostnames},\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().ModifyVpcAttribute(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error modifying VPC attribute: %v\", err)\n\t\t}\n\t}\n\n\treturn t.AddAWSTags(*e.ID, e.Tags)\n}\n","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpc.go#L202-L238","documentation":"When changes.EnableDNSSupport is set, RenderAWS calls ModifyVpcAttribute to enable/disable DNS support on the VPC. Any API failure is wrapped with this message; the VPC exists but its DNS attribute update failed.","triggerScenarios":"EC2 ModifyVpcAttribute fails: VPC deleted concurrently, throttling, unauthorized IAM (ec2:ModifyVpcAttribute), or SCP denying vpc:* modifications in shared-account setups.","commonSituations":"Applying to a shared/corporate VPC governed by an account that forbids attribute modification; transient throttling during large applies; VPC removed between find and apply.","solutions":["Ensure IAM policy allows ec2:ModifyVpcAttribute","Enable manually if policy forbids automation: `aws ec2 modify-vpc-attribute --vpc-id <id> --enable-dns-support '{\"Value\":true}'`","Re-run kops apply if the error was transient (throttling)","Confirm the VPC ID still exists"],"exampleFix":"// before: SCP blocks ModifyVpcAttribute\n// after: pre-enable via approved change process, then skip flag\nexport KOPS_FEATURE_FLAGS=VPCSkipEnableDNSSupport","handlingStrategy":"try-catch","validationCode":"out, _ := ec2Client.DescribeVpcAttribute(ctx, &ec2.DescribeVpcAttributeInput{VpcId: vpcID, Attribute: ec2types.VpcAttributeNameEnableDnsSupport})\n// skip the change if already desired state\nif fi.ValueOf(out.EnableDnsSupport) == desired { return nil }","typeGuard":null,"tryCatchPattern":"err := kopsApply()\nif err != nil && strings.Contains(err.Error(), \"error modifying VPC attribute\") {\n\t// fallback: enable attribute manually via approved change, or set VPCSkipEnableDNSSupport\n}","preventionTips":["Confirm ec2:ModifyVpcAttribute permission for the apply role","For shared VPCs, agree who owns attribute changes","Apply during low API-traffic windows to reduce throttling","Verify desired attributes before apply to make runs idempotent"],"tags":["aws","vpc","dns","iam","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}