{"record":{"id":"9d0e7d1c15639420","repo":"kubernetes/kops","slug":"error-listing-egressonlyinternetgateway-v","errorCode":null,"errorMessage":"error listing EgressOnlyInternetGateway: %v","messagePattern":"error listing EgressOnlyInternetGateway: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":1221,"sourceCode":"\t\tresourceTracker.Blocks = blocks\n\n\t\tresourceTrackers = append(resourceTrackers, resourceTracker)\n\t}\n\n\treturn resourceTrackers, nil\n}\n\nfunc DescribeEgressOnlyInternetGateways(cloud fi.Cloud) ([]ec2types.EgressOnlyInternetGateway, error) {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\n\tklog.V(2).Infof(\"Listing EC2 EgressOnlyInternetGateways\")\n\trequest := &ec2.DescribeEgressOnlyInternetGatewaysInput{\n\t\tFilters: BuildEC2Filters(cloud),\n\t}\n\tresponse, err := c.EC2().DescribeEgressOnlyInternetGateways(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing EgressOnlyInternetGateway: %v\", err)\n\t}\n\n\tvar gateways []ec2types.EgressOnlyInternetGateway\n\tgateways = append(gateways, response.EgressOnlyInternetGateways...)\n\n\treturn gateways, nil\n}\n\nfunc DeleteAutoScalingGroup(cloud fi.Cloud, r *resources.Resource) error {\n\tctx := context.TODO()\n\n\tc := cloud.(awsup.AWSCloud)\n\n\tid := r.ID\n\n\tklog.V(2).Infof(\"Deleting autoscaling group %q\", id)\n\trequest := &autoscaling.DeleteAutoScalingGroupInput{\n\t\tAutoScalingGroupName: &id,","sourceCodeStart":1203,"sourceCodeEnd":1239,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L1203-L1239","documentation":"kops wraps a failed EC2 DescribeEgressOnlyInternetGateways call when enumerating IPv6 egress-only internet gateways for a VPC. Any SDK error (auth, throttling, invalid filter) becomes this wrapped message and aborts listing of egress-only gateways during resource discovery.","triggerScenarios":"DescribeEgressOnlyInternetGateways call with BuildEC2Filters fails: missing ec2:DescribeEgressOnlyInternetGateways permission, throttling, or credentials expired.","commonSituations":"Cluster teardown listing phase fails on IPv6-enabled clusters; IAM read-only policy missing the egress-only IGW describe action; regional API outage.","solutions":["Run `aws ec2 describe-egress-only-internet-gateways` with the same credentials to surface the raw error.","Add ec2:DescribeEgressOnlyInternetGateways to the IAM policy.","Refresh expired credentials and confirm region.","Retry later if the embedded code is Throttling/RequestLimitExceeded."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if _, err := sts.New(sess).GetCallerIdentity(&sts.GetCallerIdentityInput{}); err != nil { return fmt.Errorf(\"credentials invalid: %w\", err) }","typeGuard":"func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == \"AuthFailure\" || ae.ErrorCode() == \"UnauthorizedOperation\") }","tryCatchPattern":"gateways, err := DescribeEgressOnlyInternetGateways(cloud)\nif err != nil {\n\tif isAuthError(err) { return fmt.Errorf(\"check IAM/credentials: %w\", err) }\n\treturn err\n}","preventionTips":["Include ec2:DescribeEgressOnlyInternetGateways in IAM policies","Refresh SSO/credential sessions before long kops operations","Run the equivalent aws-cli describe command to isolate auth vs throttling"],"tags":["aws","ec2","ipv6","listing","api-error"],"backgroundTag":"aws-ec2-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}