{"record":{"id":"8abe50af4d868bfb","repo":"kubernetes/kops","slug":"error-creating-eventbridge-target-v","errorCode":null,"errorMessage":"error creating EventBridge target: %v","messagePattern":"error creating EventBridge target: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/eventbridgetarget.go","lineNumber":124,"sourceCode":"\n\treturn nil\n}\n\nfunc (eb *EventBridgeTarget) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *EventBridgeTarget) error {\n\tif a == nil {\n\t\ttarget := eventbridgetypes.Target{\n\t\t\tArn: eb.SQSQueue.ARN,\n\t\t\tId:  aws.String(\"1\"),\n\t\t}\n\n\t\trequest := &eventbridge.PutTargetsInput{\n\t\t\tRule:    eb.Rule.Name,\n\t\t\tTargets: []eventbridgetypes.Target{target},\n\t\t}\n\n\t\t_, err := t.Cloud.EventBridge().PutTargets(context.TODO(), request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating EventBridge target: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\ntype terraformEventBridgeTarget struct {\n\tRuleName  *terraformWriter.Literal `cty:\"rule\"`\n\tTargetArn *terraformWriter.Literal `cty:\"arn\"`\n}\n\nfunc (_ *EventBridgeTarget) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *EventBridgeTarget) error {\n\ttf := &terraformEventBridgeTarget{\n\t\tRuleName:  e.Rule.TerraformLink(),\n\t\tTargetArn: e.SQSQueue.TerraformLink(),\n\t}\n\n\treturn t.RenderResource(\"aws_cloudwatch_event_target\", *e.Name, tf)","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/eventbridgetarget.go#L106-L142","documentation":"RenderAWS for EventBridgeTarget calls PutTargets to attach the SQS queue target to the rule and wraps any API error in this message. It fires only on the create/update branch of the target reconciliation.","triggerScenarios":"PutTargets fails: the rule does not exist, the target ARN (SQS queue) is invalid or in another region/account, sqs:SendMessage permission missing on the queue resource policy for events.amazonaws.com, or eventbridge:PutTargets denied.","commonSituations":"Queue created in a different region than the rule; SQS queue policy not granting events.amazonaws.com SendMessage; deleted/renamed rule referenced by a stale cluster spec.","solutions":["Verify the SQS queue ARN exists in the same region/account as the rule.","Add a queue policy statement allowing events.amazonaws.com to sqs:SendMessage on the queue.","Ensure the EventBridgeRule exists before PutTargets; add eventbridge:PutTargets to IAM."],"exampleFix":"// before: no queue policy\n// after: allow EventBridge to send messages\n{\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"events.amazonaws.com\"},\"Action\":\"sqs:SendMessage\",\"Resource\":\"arn:aws:sqs:us-east-1:123456789012:kops-event-queue\"}]}","handlingStrategy":"validation","validationCode":"// Verify queue ARN and region before PutTargets\nqueueArn := strings.TrimPrefix(fi.ValueOf(eb.SQSQueue.ARN), \"arn:aws:sqs:\")\nregion := strings.Split(queueArn, \":\")[0]\nif region != targetRegion { return fmt.Errorf(\"queue region %s != rule region %s\", region, targetRegion) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure the SQS queue policy allows events.amazonaws.com to sqs:SendMessage","Create rule and queue in the same region/account","Grant eventbridge:PutTargets in IAM"],"tags":["aws","eventbridge","sqs","create"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}