{"record":{"id":"8457c1b95ea1a6fd","repo":"kubernetes/kops","slug":"error-creating-internetgateway-v","errorCode":null,"errorMessage":"error creating InternetGateway: %v","messagePattern":"error creating InternetGateway: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/internetgateway.go","lineNumber":162,"sourceCode":"\tif shared {\n\t\t// Verify the InternetGateway was found and matches our required settings\n\t\tif a == nil {\n\t\t\treturn fmt.Errorf(\"InternetGateway for shared VPC was not found\")\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating InternetGateway\")\n\n\t\trequest := &ec2.CreateInternetGatewayInput{\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeInternetGateway, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating InternetGateway: %v\", err)\n\t\t}\n\n\t\te.ID = response.InternetGateway.InternetGatewayId\n\t}\n\n\tif a == nil || (changes != nil && changes.VPC != nil) {\n\t\tklog.V(2).Infof(\"Creating InternetGatewayAttachment\")\n\n\t\tattachRequest := &ec2.AttachInternetGatewayInput{\n\t\t\tVpcId:             e.VPC.ID,\n\t\t\tInternetGatewayId: e.ID,\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().AttachInternetGateway(ctx, attachRequest)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error attaching InternetGateway to VPC: %v\", err)\n\t\t}\n\t}","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/internetgateway.go#L144-L180","documentation":"This wraps the failure of the EC2 CreateInternetGateway call when kOps needs to create a new (non-shared) Internet Gateway. Any AWS-side rejection of the create call surfaces here with the underlying API error interpolated.","triggerScenarios":"t.Cloud.EC2().CreateInternetGateway returns an error during RenderAWS when a == nil and the task is not shared — typically AuthFailure/UnauthorizedOperation from missing ec2:CreateInternetGateway permission, throttling, or invalid TagSpecification (illegal tag keys/values).","commonSituations":"IAM policy missing ec2:CreateInternetGateway (common with least-privilege setups), tag keys containing forbidden characters (e.g. reserved aws: prefix), API rate limits, SCP denying EC2 resource creation.","solutions":["Grant the kOps IAM role ec2:CreateInternetGateway (and ec2:CreateTags) permission.","Check the wrapped AWS error for tag validation problems and fix the cluster tags.","Retry if throttled; use backoff.","Check for organizational SCPs blocking EC2 creation."],"exampleFix":"// before: IAM policy without create permission\n// after: add statement\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:CreateInternetGateway\",\"ec2:CreateTags\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// Pre-flight IAM simulation\naws iam simulate-principal-policy \\\n  --policy-source-arn <kops-role-arn> \\\n  --action-names ec2:CreateInternetGateway ec2:CreateTags \\\n  --query 'EvaluationResults[].EvalDecision'   # expect [\"allowed\",\"allowed\"]","typeGuard":"func isAccessDenied(err error) bool {\n    return strings.Contains(err.Error(), \"UnauthorizedOperation\") ||\n           strings.Contains(err.Error(), \"AccessDenied\")\n}","tryCatchPattern":"if strings.Contains(err.Error(), \"error creating InternetGateway\") {\n    if isAccessDenied(err) {\n        // fix IAM policy, then retry\n    } else if strings.Contains(err.Error(), \"Throttling\") {\n        time.Sleep(backoff)\n        // retry\n    }\n}","preventionTips":["Ensure kOps IAM policy includes ec2:CreateInternetGateway and ec2:CreateTags.","Avoid reserved aws: tag keys in cluster tags.","Apply backoff/retry for throttling in CI wrappers.","Check org SCPs for EC2 deny rules."],"tags":["aws","ec2","internet-gateway","iam","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}