{"record":{"id":"5fddb28635d4078e","repo":"kubernetes/kops","slug":"error-describing-natgateways-v","errorCode":null,"errorMessage":"error describing NatGateways: %v","messagePattern":"error describing NatGateways: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":857,"sourceCode":"\t\tsharedNgwIds := sets.NewString()\n\t\tif rtResponse != nil {\n\t\t\tfor _, rt := range rtResponse.RouteTables {\n\t\t\t\tfor _, t := range rt.Tags {\n\t\t\t\t\tk := aws.ToString(t.Key)\n\t\t\t\t\tv := aws.ToString(t.Value)\n\n\t\t\t\t\tif k == \"AssociatedNatgateway\" {\n\t\t\t\t\t\tsharedNgwIds.Insert(v)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tklog.V(2).Infof(\"Querying Nat Gateways\")\n\t\trequest := &ec2.DescribeNatGatewaysInput{}\n\t\tresponse, err := c.EC2().DescribeNatGateways(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error describing NatGateways: %v\", err)\n\t\t}\n\n\t\tfor _, ngw := range response.NatGateways {\n\t\t\tid := aws.ToString(ngw.NatGatewayId)\n\t\t\tif !natGatewayIds.Has(id) {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tforceShared := sharedNgwIds.Has(id) || !ownedNatGatewayIds.Has(id)\n\t\t\tr := buildNatGatewayResource(ngw, forceShared, clusterName)\n\t\t\tresourceTrackers = append(resourceTrackers, r)\n\t\t}\n\t}\n\n\treturn resourceTrackers, nil\n}\n\nfunc DescribeSubnets(cloud fi.Cloud) ([]ec2types.Subnet, error) {","sourceCodeStart":839,"sourceCodeEnd":875,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L839-L875","documentation":"ListSubnets calls ec2:DescribeNatGateways to enumerate NAT gateways and wraps any failure in this error. It means NAT gateway discovery failed, preventing detection of which subnets' NGWs are shared and should not be deleted. The raw AWS error is embedded via %v.","triggerScenarios":"ec2.DescribeNatGateways fails: UnauthorizedOperation (missing ec2:DescribeNatGateways), RequestLimitExceeded throttling, invalid credentials, transient API/network failure, or calling it in a region/account without NGW support enabled.","commonSituations":"IAM policies granting EC2 read permissions selectively but omitting NAT gateway APIs; throttling in accounts with many VPCs; kops version/regional endpoint issues.","solutions":["Add ec2:DescribeNatGateways to the IAM policy.","Retry with backoff if throttled (RequestLimitExceeded/ThrottlingException).","Verify credentials and region are correct for the cluster.","Check AWS service health / endpoint connectivity if persistent."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if _, err := ec2Client.DescribeNatGateways(ctx, &ec2.DescribeNatGatewaysInput{NatGatewayIds: []string{\"probe\"}}); isAuthError(err) { return fmt.Errorf(\"IAM lacks ec2:DescribeNatGateways: %w\", err) }","typeGuard":"func isThrottling(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == \"RequestLimitExceeded\" || ae.ErrorCode() == \"ThrottlingException\") }","tryCatchPattern":"if err != nil {\n  if isThrottling(err) { return retryWithBackoff(op, 5) }\n  if isAuthError(err) { return fmt.Errorf(\"grant ec2:DescribeNatGateways: %w\", err) }\n  return err\n}","preventionTips":["Include ec2:DescribeNatGateways in the EC2 read IAM policy.","Configure the SDK retry mode (adaptive) and higher max attempts.","Spread large batch listings over time to dodge rate limits.","Confirm the region supports/has NAT gateways provisioned for the VPC."],"tags":["aws","ec2","nat-gateway","api-error"],"backgroundTag":"aws-throttling-request-limit-exceeded","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}