{"record":{"id":"60ecec6071953786","repo":"kubernetes/kops","slug":"error-deleting-securitygroup-q-v","errorCode":null,"errorMessage":"error deleting SecurityGroup %q: %v","messagePattern":"error deleting SecurityGroup %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/securitygroup.go","lineNumber":103,"sourceCode":"\t\t\t}\n\t\t\t_, err = c.EC2().RevokeSecurityGroupIngress(ctx, revoke)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"cannot revoke ingress for ID %q with rule IDs %v: %v\", id, ingressRuleIDs, err)\n\t\t\t}\n\t\t}\n\t}\n\n\t{\n\t\tklog.V(2).Infof(\"Deleting EC2 SecurityGroup %q\", id)\n\t\trequest := &ec2.DeleteSecurityGroupInput{\n\t\t\tGroupId: &id,\n\t\t}\n\t\t_, err := c.EC2().DeleteSecurityGroup(ctx, request)\n\t\tif err != nil {\n\t\t\tif IsDependencyViolation(err) {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error deleting SecurityGroup %q: %v\", id, err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc DumpSecurityGroup(op *resources.DumpOperation, r *resources.Resource) error {\n\tdata := make(map[string]interface{})\n\tdata[\"id\"] = r.ID\n\tdata[\"type\"] = ec2types.ResourceTypeSecurityGroup\n\tdata[\"raw\"] = r.Obj\n\top.Dump.Resources = append(op.Dump.Resources, data)\n\treturn nil\n}\n\nfunc ListSecurityGroups(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\tgroups, err := DescribeSecurityGroups(cloud, clusterName)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/securitygroup.go#L85-L121","documentation":"In DeleteSecurityGroup (pkg/resources/aws/securitygroup.go:103), after clearing rules the SG is deleted via DeleteSecurityGroup. Dependency violations (IsDependencyViolation, e.g. DependencyViolation / another resource in use) are returned raw so the deletion loop can retry; any other error is wrapped with this message. It means the final DeleteSecurityGroup call failed for a non-dependency reason.","triggerScenarios":"EC2 DeleteSecurityGroup failing with errors other than dependency violations: UnauthorizedOperation (missing ec2:DeleteSecurityGroup), InvalidGroup.NotFound shapes not pre-filtered (race after describe), AuthFailure, throttling, or network errors.","commonSituations":"IAM policy lacking DeleteSecurityGroup; SG deleted concurrently by another process between describe and delete; SG still attached to an ENI with a differently-detected dependency error; deleting shared (non-owned) groups blocked by policy.","solutions":["Grant ec2:DeleteSecurityGroup in the IAM policy.","If InvalidGroup.NotFound, treat as success and skip (group was concurrently removed).","Check the raw wrapped AWS error code; fix the specific cause (ENI attachments, region mismatch, credentials).","Retry later if throttled or if a dependency violation race occurred."],"exampleFix":"// before\nreturn fmt.Errorf(\"error deleting SecurityGroup %q: %v\", id, err)\n// after\nif awsup.AWSErrorCode(err) == \"InvalidGroup.NotFound\" {\n    klog.V(2).Infof(\"SecurityGroup %q already deleted\", id)\n    return nil\n}\nreturn fmt.Errorf(\"error deleting SecurityGroup %q: %w\", id, err)","handlingStrategy":"try-catch","validationCode":"// ensure no ENIs still reference the SG before deleting\nenis, _ := ec2Client.DescribeNetworkInterfaces(ctx, &ec2.DescribeNetworkInterfacesInput{\n    Filters: []ec2types.Filter{{Name: aws.String(\"group-id\"), Values: []string{id}}},\n})\nif len(enis.NetworkInterfaces) > 0 { return fmt.Errorf(\"SG %q still attached to %d ENIs\", id, len(enis.NetworkInterfaces)) }","typeGuard":"func isDependencyViolationErr(err error) bool { return IsDependencyViolation(err) }\nfunc isNotFoundErr(err error) bool { return awsup.AWSErrorCode(err) == \"InvalidGroup.NotFound\" }","tryCatchPattern":"_, err := ec2Client.DeleteSecurityGroup(ctx, req)\nif err != nil {\n    if isNotFoundErr(err) { return nil }\n    if isDependencyViolationErr(err) { return err } // retried by deletion loop\n    return fmt.Errorf(\"error deleting SecurityGroup %q: %w\", id, err)\n}","preventionTips":["Grant ec2:DeleteSecurityGroup in the deletion role.","Order deletion so dependent resources (ENIs, LBs, instances) go first.","Treat InvalidGroup.NotFound as success in idempotent cleanup.","Retry dependency violations with delays — kops already re-queues them."],"tags":["aws","ec2","security-group","delete","dependency-violation"],"backgroundTag":"aws-resource-in-use","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}