{"record":{"id":"a5b1ad2118fe4d78","repo":"kubernetes/kops","slug":"error-from-describenatgateways-v","errorCode":null,"errorMessage":"error from DescribeNatGateways: %v","messagePattern":"error from DescribeNatGateways: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":1392,"sourceCode":"\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\tfor natGatewayId := range natGatewayIds {\n\t\trequest := &ec2.DescribeNatGatewaysInput{\n\t\t\tNatGatewayIds: []string{natGatewayId},\n\t\t}\n\t\tresponse, err := c.EC2().DescribeNatGateways(ctx, request)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == \"NatGatewayNotFound\" {\n\t\t\t\tklog.V(2).Infof(\"Got NatGatewayNotFound describing NatGateway %s; will treat as already-deleted\", natGatewayId)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"error from DescribeNatGateways: %v\", err)\n\t\t}\n\n\t\tif response.NextToken != nil {\n\t\t\treturn nil, fmt.Errorf(\"NextToken set from DescribeNatGateways, but pagination not implemented\")\n\t\t}\n\n\t\tfor _, ngw := range response.NatGateways {\n\t\t\tnatGatewayId := aws.ToString(ngw.NatGatewayId)\n\n\t\t\tforceShared := !ownedNatGatewayIds.Has(natGatewayId)\n\t\t\tngwResource := buildNatGatewayResource(ngw, forceShared, clusterName)\n\t\t\tresourceTrackers = append(resourceTrackers, ngwResource)\n\n\t\t\t// Don't try to remove ElasticIPs if NatGateway is shared\n\t\t\tif ngwResource.Shared {\n\t\t\t\tcontinue\n\t\t\t}\n","sourceCodeStart":1374,"sourceCodeEnd":1410,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L1374-L1410","documentation":"Thrown when EC2 DescribeNatGateways fails for a specific NAT gateway ID with anything other than NatGatewayNotFound (which is treated as already-deleted). It aborts FindNatGateways during cluster resource listing.","triggerScenarios":"DescribeNatGateways for a single NatGatewayId returns UnauthorizedOperation, ThrottlingException, AuthFailure, or Malformed ID errors.","commonSituations":"NAT gateway deleted concurrently (other NotFound codes surfaces differ); IAM policy missing ec2:DescribeNatGateways; throttling during large enumerations.","solutions":["Check the embedded error code; for throttling, retry after backoff.","Grant ec2:DescribeNatGateways to the IAM identity.","Verify NAT gateway state via `aws ec2 describe-nat-gateways --nat-gateway-ids <id>`.","Refresh credentials if AuthFailure/ExpiredToken."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"out, err := ec2Client.DescribeNatGateways(ctx, &ec2.DescribeNatGatewaysInput{NatGatewayIds: []string{id}}); if err != nil || len(out.NatGateways) == 0 { /* treat as deleted */ }","typeGuard":"func isNatGatewayMissing(err error) bool { code := awsup.AWSErrorCode(err); return code == \"NatGatewayNotFound\" || code == \"InvalidNatGatewayID.NotFound\" }","tryCatchPattern":"err := /* wrapped DescribeNatGateways error */\nif isNatGatewayMissing(err) { return nil } // already deleted\nreturn err","preventionTips":["Grant ec2:DescribeNatGateways in IAM","Handle both NatGatewayNotFound and InvalidNatGatewayID.NotFound codes defensively","Back off on throttling during large enumerations"],"tags":["aws","ec2","nat-gateway","api-error"],"backgroundTag":"aws-ec2-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}