{"record":{"id":"61d41e39620388fa","repo":"kubernetes/kops","slug":"error-revoking-securitygroupegress-v","errorCode":null,"errorMessage":"error revoking SecurityGroupEgress: %v","messagePattern":"error revoking SecurityGroupEgress: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygroup.go","lineNumber":261,"sourceCode":"func (d *deleteSecurityGroupRule) Delete(t fi.CloudupTarget) error {\n\tctx := context.TODO()\n\tklog.V(2).Infof(\"deleting security group permission: %v\", fi.DebugAsJsonString(d.rule))\n\n\tawsTarget, ok := t.(*awsup.AWSAPITarget)\n\tif !ok {\n\t\treturn fmt.Errorf(\"unexpected target type for deletion: %T\", t)\n\t}\n\n\tif aws.ToBool(d.rule.IsEgress) {\n\t\trequest := &ec2.RevokeSecurityGroupEgressInput{\n\t\t\tGroupId:              d.rule.GroupId,\n\t\t\tSecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},\n\t\t}\n\n\t\tklog.V(2).Infof(\"Calling EC2 RevokeSecurityGroupEgress\")\n\t\t_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupEgress(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error revoking SecurityGroupEgress: %v\", err)\n\t\t}\n\t} else {\n\t\trequest := &ec2.RevokeSecurityGroupIngressInput{\n\t\t\tGroupId:              d.rule.GroupId,\n\t\t\tSecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},\n\t\t}\n\n\t\tklog.V(2).Infof(\"Calling EC2 RevokeSecurityGroupIngress\")\n\t\t_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupIngress(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error revoking SecurityGroupIngress: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (d *deleteSecurityGroupRule) TaskName() string {","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygroup.go#L243-L279","documentation":"Wraps a failure from the EC2 RevokeSecurityGroupEgress API while the deleteSecurityGroupRule task is deleting an extra egress rule on a security group during `kops update` reconciliation. The wrapped AWS error (auth, throttling, invalid rule id, deleted group, etc.) is appended verbatim. It is raised only when d.rule.IsEgress is true in deleteSecurityGroupRule.Delete.","triggerScenarios":"FindDeletions produced a CloudupDeletion for an egress rule (via removeExtraRules) and the subsequent RevokeSecurityGroupEgress call failed — e.g. InvalidGroup.NotFound (group already deleted), InvalidPermission.NotFound / InvalidSecurityGroupRuleId.NotFound (rule already revoked or ID stale from a cached Describe), throttling (RequestLimitExceeded), or revoked IAM credentials.","commonSituations":"Racing deletions where the security group was removed between Describe and Revoke; running kops concurrently in two processes causing double-revoke of the same rule id; expired AWS session/credentials mid-run; an operator manually deleted the rule in the AWS console while kops was applying.","solutions":["Re-run `kops update cluster --yes` — most causes (stale rule id, already-deleted rule) self-heal on the next reconciliation","Run `aws ec2 describe-security-group-rules --filter Name=group-id,Values=<sg-id>` to check whether the rule/group still exists","Check `kops toolbox dump` / IAM: ensure credentials and the IAM policy ec2:RevokeSecurityGroupEgress are valid","Retry after a short wait if the wrapped error is throttling (RequestLimitExceeded)"],"exampleFix":"// N/A — error surfaces from AWS; caller-side retry is the fix (null if not applicable)","handlingStrategy":"retry","validationCode":"// Before applying, confirm the egress rule id still exists:\naws ec2 describe-security-group-rules \\\n  --filters Name=group-id,Values=$SG_ID Name=security-group-rule-id,Values=$RULE_ID \\\n  --query 'SecurityGroupRules[0].SecurityGroupRuleId'","typeGuard":null,"tryCatchPattern":"// kops surfaces this as a wrapped error; when automating:\nif err := apply(); err != nil {\n  if strings.Contains(err.Error(), \"error revoking SecurityGroupEgress\") {\n    // transient (throttle/stale id) → sleep and re-run the update\n    time.Sleep(30 * time.Second); retryApply()\n  }\n}","preventionTips":["Avoid running concurrent kops updates against the same cluster","Don't delete security group rules manually in the console while an apply is running","Use `kops update cluster` without --yes (dry-run) first to see planned rule deletions","Ensure the AWS principal has ec2:RevokeSecurityGroupEgress granted"],"tags":["aws","ec2","security-group","revoke-egress"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}