{"record":{"id":"67450dfd6cbeef28","repo":"kubernetes/kops","slug":"error-creating-securitygroupingress-v","errorCode":null,"errorMessage":"error creating SecurityGroupIngress: %v","messagePattern":"error creating SecurityGroupIngress: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygrouprule.go","lineNumber":332,"sourceCode":"\t\t\trequest.IpPermissions = []ec2types.IpPermission{ipPermission}\n\t\t\trequest.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)\n\n\t\t\tklog.V(2).Infof(\"%s: Calling EC2 AuthorizeSecurityGroupEgress (%s)\", name, description)\n\t\t\t_, err := t.Cloud.EC2().AuthorizeSecurityGroupEgress(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error creating SecurityGroupEgress: %v\", err)\n\t\t\t}\n\t\t} else {\n\t\t\trequest := &ec2.AuthorizeSecurityGroupIngressInput{\n\t\t\t\tGroupId: e.SecurityGroup.ID,\n\t\t\t}\n\t\t\trequest.IpPermissions = []ec2types.IpPermission{ipPermission}\n\t\t\trequest.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)\n\n\t\t\tklog.V(2).Infof(\"%s: Calling EC2 AuthorizeSecurityGroupIngress (%s)\", name, description)\n\t\t\t_, err := t.Cloud.EC2().AuthorizeSecurityGroupIngress(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error creating SecurityGroupIngress: %v\", err)\n\t\t\t}\n\t\t}\n\n\t} else if changes.Tags != nil {\n\t\treturn t.AddAWSTags(*a.ID, e.Tags)\n\t}\n\n\t// No tags on security group rules (there are tags on the group though)\n\n\treturn nil\n}\n\ntype terraformSecurityGroupIngress struct {\n\tType *string `cty:\"type\"`\n\n\tSecurityGroup *terraformWriter.Literal `cty:\"security_group_id\"`\n\tSourceGroup   *terraformWriter.Literal `cty:\"source_security_group_id\"`\n","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygrouprule.go#L314-L350","documentation":"RenderAWS (creation path, a==nil) calls AuthorizeSecurityGroupIngress to create a new ingress rule, and wraps any AWS failure here. Raised for new SecurityGroupRule tasks with Egress false/nil, including rules whose source is another security group (UserIdGroupPairs).","triggerScenarios":"AuthorizeSecurityGroupIngress fails: InvalidGroup.NotFound (target or source SG gone mid-apply), InvalidParameterValue (malformed CIDR/prefix list), referenced SourceGroup in another account without allow-cross-account permissions, throttling, or AccessDenied on ec2:AuthorizeSecurityGroupIngress.","commonSituations":"Cluster spec references a SourceGroup that was deleted or not yet created in this apply run; typo'd CIDR; node→master SG reference invalid after cluster re-creation; IAM lacking the ingress authorize action.","solutions":["Read the wrapped AWS error to identify the exact AWS cause (bad parameter vs missing group vs auth)","Verify SourceGroup IDs exist in the same VPC/region; if cross-account, ensure the other account allows it","Validate CIDR/IPv6CIDR/PrefixList values in the spec (valid CIDR notation, pl- prefix)","Fix IAM permissions (ec2:AuthorizeSecurityGroupIngress) or credentials, then re-run `kops update cluster --yes`"],"exampleFix":"// before (IAM policy)\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:AuthorizeSecurityGroupEgress\"],\"Resource\":\"*\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:AuthorizeSecurityGroupEgress\",\"ec2:AuthorizeSecurityGroupIngress\"],\"Resource\":\"*\"}","handlingStrategy":"validation","validationCode":"// Validate inputs before applying:\nimport \"net\"\nfunc validCIDR(s string) bool { _, _, err := net.ParseCIDR(s); return err == nil }\n// Ensure both target and source SGs exist in the same VPC:\naws ec2 describe-security-groups --group-ids $SG_ID,$SOURCE_SG_ID","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n  if strings.Contains(err.Error(), \"error creating SecurityGroupIngress\") {\n    // InvalidGroup.NotFound → source/target SG missing; InvalidParameterValue → bad CIDR;\n    // AccessDenied → IAM. Log and fix the wrapped AWS cause.\n    log.Println(err)\n  }\n}","preventionTips":["Ensure SourceGroup rules reference SGs created in the same apply/VPC","Validate all CIDR/IPv6CIDR/PrefixList values in specs","Grant ec2:AuthorizeSecurityGroupIngress to the automation role","For cross-account source groups, confirm the peer account permits it"],"tags":["aws","ec2","security-group","ingress","authorize-api"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}