{"record":{"id":"9a0842fa81062491","repo":"kubernetes/kops","slug":"error-deleting-subnet-q-v","errorCode":null,"errorMessage":"error deleting Subnet %q: %v","messagePattern":"error deleting Subnet %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":750,"sourceCode":"func DeleteSubnet(cloud fi.Cloud, tracker *resources.Resource) error {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\n\tid := tracker.ID\n\n\tklog.V(2).Infof(\"Deleting EC2 Subnet %q\", id)\n\trequest := &ec2.DeleteSubnetInput{\n\t\tSubnetId: &id,\n\t}\n\t_, err := c.EC2().DeleteSubnet(ctx, request)\n\tif err != nil {\n\t\tif awsup.AWSErrorCode(err) == \"InvalidSubnetID.NotFound\" {\n\t\t\tklog.V(2).Infof(\"Got InvalidSubnetID.NotFound error deleting subnet %q; will treat as already-deleted\", id)\n\t\t\treturn nil\n\t\t} else if IsDependencyViolation(err) {\n\t\t\treturn err\n\t\t}\n\t\treturn fmt.Errorf(\"error deleting Subnet %q: %v\", id, err)\n\t}\n\treturn nil\n}\n\nfunc ListSubnets(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\tsubnets, err := DescribeSubnets(cloud)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing subnets: %v\", err)\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\telasticIPs := sets.NewString()\n\townedElasticIPs := sets.NewString()\n\tnatGatewayIds := sets.NewString()\n\townedNatGatewayIds := sets.NewString()\n\tfor _, subnet := range subnets {","sourceCodeStart":732,"sourceCodeEnd":768,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L732-L768","documentation":"DeleteSubnet wraps DeleteSubnet API failures in this error, except InvalidSubnetID.NotFound (treated as already-deleted) and dependency violations returned as-is via IsDependencyViolation. It means AWS refused subnet deletion for a real subnet, most commonly because resources still exist in it.","triggerScenarios":"ec2.DeleteSubnet fails with errors like DependencyViolation (ENIs, NAT gateways, or instances still in the subnet), UnauthorizedOperation, or throttling — while InvalidSubnetID.NotFound is filtered out beforehand.","commonSituations":"Deleting a cluster whose subnets still contain leftover ENIs (LBs, lambda VPC attachments); orphaned NAT gateways; deleting a subnet shared from another account; IAM denials.","solutions":["Resolve the DependencyViolation: list and delete remaining ENIs, NAT gateways, and instances in the subnet, then retry.","Wait a few minutes — AWS dependency cleanup is sometimes asynchronous — then retry.","Check whether the subnet is shared (RAM) and must be deleted by the owner account.","Verify IAM allows ec2:DeleteSubnet; retry with backoff if throttled."],"exampleFix":"// before\nreturn fmt.Errorf(\"error deleting Subnet %q: %v\", id, err)\n// after\nif awsup.AWSErrorCode(err) == \"DependencyViolation\" {\n  klog.V(2).Infof(\"subnet %q has dependencies; cleaning up ENIs before retry\", id)\n  CleanupSubnetENIs(cloud, id)\n  return RetryDeleteSubnet(cloud, id)\n}\nreturn fmt.Errorf(\"error deleting Subnet %q: %v\", id, err)","handlingStrategy":"retry","validationCode":"enis, _ := ec2Client.DescribeNetworkInterfaces(ctx, &ec2.DescribeNetworkInterfacesInput{Filters: []types.Filter{awsup.NewEC2Filter(\"subnet-id\", id)}})\nif len(enis.NetworkInterfaces) > 0 { return fmt.Errorf(\"subnet %s still has %d ENIs\", id, len(enis.NetworkInterfaces)) }","typeGuard":"func isDependencyViolationErr(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == \"DependencyViolation\" }","tryCatchPattern":"err := DeleteSubnet(cloud, id)\nif isDependencyViolationErr(err) {\n  cleanupSubnetResources(cloud, id)\n  time.Sleep(30 * time.Second)\n  return DeleteSubnet(cloud, id)\n}","preventionTips":["Tear down dependent resources (NLBs, NAT GWs, instances) before subnets.","Sweep leftover ENIs — LoadBalancer-created ENIs are the most common blocker.","Retry subnet deletion after a delay; AWS dependency cleanup can lag.","Check for RAM-shared subnets owned by another account."],"tags":["aws","ec2","vpc","subnet-deletion"],"backgroundTag":"aws-dependency-violation","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}