{"record":{"id":"7a211bd7a327cb28","repo":"kubernetes/kops","slug":"error-configuring-nlb-attributes-for-nlb-q-v","errorCode":null,"errorMessage":"error configuring NLB attributes for NLB %q: %v","messagePattern":"error configuring NLB attributes for NLB %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/networkloadbalancer_attributes.go","lineNumber":122,"sourceCode":"\t\t\tValue: e.AccessLog.S3BucketName,\n\t\t}\n\t\tattributes = append(attributes, attr)\n\t}\n\tif e.AccessLog != nil && e.AccessLog.S3BucketPrefix != nil {\n\t\tattr := elbv2types.LoadBalancerAttribute{\n\t\t\tKey:   aws.String(\"access_logs.s3.prefix\"),\n\t\t\tValue: e.AccessLog.S3BucketPrefix,\n\t\t}\n\t\tattributes = append(attributes, attr)\n\t}\n\n\trequest.Attributes = attributes\n\n\tklog.V(2).Infof(\"Configuring NLB attributes for NLB %q\", loadBalancerArn)\n\n\tresponse, err := t.Cloud.ELBV2().ModifyLoadBalancerAttributes(ctx, request)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error configuring NLB attributes for NLB %q: %v\", loadBalancerArn, err)\n\t}\n\n\tklog.V(4).Infof(\"modified NLB attributes for NLB %q, response %+v\", loadBalancerArn, response)\n\n\treturn nil\n}\n","sourceCodeStart":104,"sourceCodeEnd":129,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/networkloadbalancer_attributes.go#L104-L129","documentation":"modifyLoadBalancerAttributes calls ELBV2 ModifyLoadBalancerAttributes for a Network Load Balancer and wraps any API error with this message, including the NLB ARN. It means kOps could not apply desired attributes (e.g. access logs, delete protection, cross-zone load balancing) to the NLB.","triggerScenarios":"ModifyLoadBalancerAttributes rejected: invalid attribute combination, delete_protection.enabled=true while trying to delete/modify, access logs S3 bucket misconfigured or lacking permissions, unsupported attribute values, or the ARN is wrong/not found.","commonSituations":"Enabling access logging with a bucket in the wrong region or missing elb log delivery policy; attempting cluster teardown while deletion_protection is enabled; typo'd or deprecated attribute keys after AWS SDK upgrades.","solutions":["Inspect the wrapped AWS error for the rejected attribute","If delete protection is on, disable deletion_protection.enabled before deleting/modifying","Verify access-logs S3 bucket exists, is in the same region, and has the ELB log-delivery bucket policy","Check attribute names/values against current aws-sdk-go-v2 elbv2 API"],"exampleFix":"// before: delete protection blocks teardown\nattributes[\"load_balancing.cross_zone.enabled\"] = \"true\"\nattributes[\"deletion_protection.enabled\"] = \"true\"\n// after: allow deletion during cluster teardown\nattributes[\"deletion_protection.enabled\"] = \"false\"","handlingStrategy":"retry","validationCode":"// verify S3 access-logs setup before enabling\nif attrs[\"access_logs.s3.enabled\"] == \"true\" {\n  if !s3BucketHasELBDeliveryPolicy(bucket, region) { return fmt.Errorf(\"bucket %s lacks ELB delivery policy\", bucket) }\n}","typeGuard":null,"tryCatchPattern":"response, err := t.Cloud.ELBV2().ModifyLoadBalancerAttributes(ctx, request)\nif err != nil {\n  if isThrottling(err) { /* retry with backoff */ }\n  return fmt.Errorf(\"error configuring NLB attributes for NLB %q: %v\", loadBalancerArn, err)\n}","preventionTips":["Disable deletion_protection before cluster teardown","Verify S3 bucket region and delivery policy for access logs","Cross-check attribute keys against the current aws-sdk-go-v2 elbv2 API","Retry throttled calls with backoff"],"tags":["aws","elbv2","nlb","attributes"],"backgroundTag":"nlb-attributes-modify-rejected","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}