{"record":{"id":"7984d87f4ee752b7","repo":"kubernetes/kops","slug":"error-describing-addresses-v","errorCode":null,"errorMessage":"error describing addresses: %v","messagePattern":"error describing addresses: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":634,"sourceCode":"\t\tfor _, tag := range volume.Tags {\n\t\t\tname := aws.ToString(tag.Key)\n\t\t\tip := \"\"\n\t\t\tif name == \"kubernetes.io/master-ip\" {\n\t\t\t\tip = aws.ToString(tag.Value)\n\t\t\t}\n\t\t\tif ip != \"\" {\n\t\t\t\telasticIPs[ip] = true\n\t\t\t}\n\t\t}\n\n\t}\n\n\tif len(elasticIPs) != 0 {\n\t\tklog.V(2).Infof(\"Querying EC2 Elastic IPs\")\n\t\trequest := &ec2.DescribeAddressesInput{}\n\t\tresponse, err := c.EC2().DescribeAddresses(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error describing addresses: %v\", err)\n\t\t}\n\n\t\tfor _, address := range response.Addresses {\n\t\t\tip := aws.ToString(address.PublicIp)\n\t\t\tif !elasticIPs[ip] {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tresourceTrackers = append(resourceTrackers, buildElasticIPResource(address, false, clusterName))\n\t\t}\n\t}\n\n\treturn resourceTrackers, nil\n}\n\nfunc DescribeVolumes(cloud fi.Cloud) ([]ec2types.Volume, error) {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)","sourceCodeStart":616,"sourceCodeEnd":652,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L616-L652","documentation":"ListVolumes calls ec2:DescribeAddresses to discover Elastic IPs associated with volumes, and wraps any DescribeAddresses failure in this error. It means the EC2 API rejected the address query entirely, so no volume listing can be produced. The underlying AWS error is embedded via %v.","triggerScenarios":"ec2.DescribeAddresses returns any error: throttling (RequestLimitExceeded), AuthFailure/UnauthorizedOperation from IAM, invalid credentials, or a regional endpoint/network failure.","commonSituations":"Expired or missing AWS credentials (env vars/profile/instance role) during cluster listing; rate limiting when enumerating many clusters; IAM policy lacking ec2:DescribeAddresses; wrong region configuration.","solutions":["Verify AWS credentials and region (kops set-cluster, env vars, ~/.aws/credentials) are valid.","Add ec2:DescribeAddresses to the caller's IAM policy.","Retry with backoff if the error is RequestLimitExceeded/throttling.","Check network/proxy connectivity to the EC2 endpoint for the configured region."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"creds, err := config.LoadDefaultConfig(ctx)\nif err != nil { return fmt.Errorf(\"no valid AWS config: %w\", err) }\n_, err = creds.Credentials.Retrieve(ctx)\nif err != nil { return fmt.Errorf(\"AWS credentials not resolvable: %w\", err) }","typeGuard":"func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == \"AuthFailure\" || ae.ErrorCode() == \"UnauthorizedOperation\") }","tryCatchPattern":"if err != nil {\n  if isThrottling(err) { backoffRetry(op) }\n  if isAuthError(err) { return fmt.Errorf(\"check IAM ec2:DescribeAddresses: %w\", err) }\n  return err\n}","preventionTips":["Run `aws sts get-caller-identity` to validate credentials before kops operations.","Keep ec2:DescribeAddresses in the kops instance/user IAM policy.","Set explicit region instead of relying on defaults.","Add jittered retries for EC2 read calls in automation loops."],"tags":["aws","ec2","elastic-ip","api-error"],"backgroundTag":"aws-credentials-or-iam-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}