{"record":{"id":"7e85462ad0b5b664","repo":"kubernetes/kops","slug":"listing-elb-targetgroup-tags-w","errorCode":null,"errorMessage":"listing ELB TargetGroup tags: %w","messagePattern":"listing ELB TargetGroup tags: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/elbv2_targetgroups.go","lineNumber":83,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"listing ELB TargetGroups: %w\", err)\n\t\t}\n\t\tif len(page.TargetGroups) == 0 {\n\t\t\tbreak\n\t\t}\n\n\t\ttagRequest := &elbv2.DescribeTagsInput{}\n\n\t\tfor _, tg := range page.TargetGroups {\n\t\t\tarn := aws.ToString(tg.TargetGroupArn)\n\t\t\tbyARN[arn] = &TargetGroupInfo{TargetGroup: tg, ARN: arn}\n\n\t\t\ttagRequest.ResourceArns = append(tagRequest.ResourceArns, aws.ToString(tg.TargetGroupArn))\n\t\t}\n\n\t\ttagResponse, err := cloud.ELBV2().DescribeTags(ctx, tagRequest)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"listing ELB TargetGroup tags: %w\", err)\n\t\t}\n\n\t\tfor _, t := range tagResponse.TagDescriptions {\n\t\t\tarn := aws.ToString(t.ResourceArn)\n\n\t\t\tinfo := byARN[arn]\n\t\t\tif info == nil {\n\t\t\t\tklog.Fatalf(\"found tag for load balancer we didn't ask for %q\", arn)\n\t\t\t}\n\n\t\t\tinfo.Tags = append(info.Tags, t.Tags...)\n\t\t}\n\t}\n\n\tcloudTags := cloud.Tags()\n\n\tvar results []*TargetGroupInfo\n\tfor _, v := range byARN {","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/elbv2_targetgroups.go#L65-L101","documentation":"Inside ListELBV2TargetGroups, the batched ELBV2 DescribeTags call for the page's target group ARNs can fail; the error is wrapped with this message. Like the load balancer variant, it is usually an IAM, throttling, or transient API problem rather than a code bug.","triggerScenarios":"DescribeTags call for target group ARNs fails: missing elasticloadbalancing:DescribeTags permission, throttling with many target groups, target groups deleted between listing and tagging, network errors.","commonSituations":"Restricted IAM roles used by CI; accounts with hundreds of target groups hitting DescribeTags limits; race conditions with external tooling deleting target groups mid-listing.","solutions":["Add elasticloadbalancing:DescribeTags to the IAM policy.","Retry with exponential backoff on throttling errors.","Inspect the wrapped SDK error code via errors.As to distinguish AccessDenied vs Throttling vs not-found.","Re-run; if target groups were concurrently deleted, listing again will succeed."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"tgs, err := cloud.ListELBV2TargetGroups()\nif err != nil {\n\tvar ae smithy.APIError\n\tif errors.As(err, &ae) && strings.Contains(ae.ErrorMessage(), \"DescribeTags\") || ae.ErrorCode() == \"AccessDenied\" {\n\t\t// report missing elasticloadbalancing:DescribeTags permission\n\t}\n\treturn err\n}","preventionTips":["Include DescribeTags whenever DescribeTargetGroups is granted","Retry transient tag-fetch failures instead of aborting the whole listing","Treat deletions by external tooling as expected; re-run listing"],"tags":["aws","elbv2","iam","tags","target-group"],"backgroundTag":"aws-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}