{"record":{"id":"aa28a0860b068b54","repo":"kubernetes/kops","slug":"error-creating-egressonlyinternetgateway-v","errorCode":null,"errorMessage":"error creating EgressOnlyInternetGateway: %v","messagePattern":"error creating EgressOnlyInternetGateway: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go","lineNumber":162,"sourceCode":"\t\t// Verify the EgressOnlyInternetGateway was found and matches our required settings\n\t\tif a == nil {\n\t\t\treturn fmt.Errorf(\"EgressOnlyInternetGateway for shared VPC was not found\")\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating EgressOnlyInternetGateway\")\n\n\t\trequest := &ec2.CreateEgressOnlyInternetGatewayInput{\n\t\t\tVpcId:             e.VPC.ID,\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeEgressOnlyInternetGateway, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateEgressOnlyInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating EgressOnlyInternetGateway: %v\", err)\n\t\t}\n\n\t\te.ID = response.EgressOnlyInternetGateway.EgressOnlyInternetGatewayId\n\t\treturn nil\n\t}\n\n\treturn t.UpdateTags(*e.ID, e.Tags)\n}\n\ntype terraformEgressOnlyInternetGateway struct {\n\tVPCID *terraformWriter.Literal `cty:\"vpc_id\"`\n\tTags  map[string]string        `cty:\"tags\"`\n}\n\nfunc (_ *EgressOnlyInternetGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *EgressOnlyInternetGateway) error {\n\tctx := context.TODO()\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go#L144-L180","documentation":"RenderAWS creates a new Egress-Only Internet Gateway via EC2 CreateEgressOnlyInternetGateway for non-shared tasks. If that AWS API call fails (network, permissions, invalid VPC ID, throttling), the underlying SDK error is wrapped with this message and propagated up through the kOps apply loop, aborting cluster reconciliation.","triggerScenarios":"kops update/apply with Shared=false and no existing gateway: t.Cloud.EC2().CreateEgressOnlyInternetGateway returns an error — e.g. InvalidVpcID.NotFound, AccessDenied, throttling, or connectivity failure.","commonSituations":"Typo in VPC ID in the cluster spec; IAM role lacking ec2:CreateEgressOnlyInternetGateway; region misconfiguration pointing kOps at a VPC from another region; AWS API throttling or transient outages during large applies.","solutions":["Read the wrapped AWS SDK error to identify the root cause (invalid VPC ID vs access denied vs throttling).","Verify the VPC ID exists in the target region: aws ec2 describe-vpcs --vpc-ids vpc-...","Grant the kOps IAM role ec2:CreateEgressOnlyInternetGateway (and related attach/tag permissions).","Retry after transient throttling/outage; kops update is generally idempotent.","Check AWS service health / network connectivity to EC2 endpoints (especially in air-gapped or proxy setups)."],"exampleFix":"// before\nreturn fmt.Errorf(\"error creating EgressOnlyInternetGateway: %v\", err)\n// after — fix the underlying cause, e.g. ensure the VPC exists in the region:\n// aws ec2 describe-vpcs --region us-east-1 --vpc-ids $VPC_ID\n// then re-run: kops update cluster --yes","handlingStrategy":"try-catch","validationCode":"// verify preconditions before apply\naws ec2 describe-vpcs --vpc-ids vpc-0abc123456789def0\naws iam simulate-principal-policy --policy-source-arn $KOPS_ROLE_ARN \\\n  --action-names ec2:CreateEgressOnlyInternetGateway","typeGuard":null,"tryCatchPattern":"if err := applyErr(); err != nil {\n    var apiErr smithy.APIError\n    if errors.As(err, &apiErr) {\n        switch apiErr.ErrorCode() {\n        case \"InvalidVpcID.NotFound\":\n            // fix VPC ID in spec\n        case \"AccessDenied\":\n            // fix IAM policy\n        case \"Throttling\", \"RequestLimitExceeded\":\n            // back off and retry\n        }\n    }\n    return err\n}","preventionTips":["Test that the VPC ID exists in the kOps-target region before applying.","Include ec2:CreateEgressOnlyInternetGateway in the kOps IAM policy.","Use retry/backoff around kops update for throttling-prone environments.","Watch AWS health dashboards during large applies."],"tags":["aws","ec2","vpc","ipv6","api-error"],"backgroundTag":"aws-api-create-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}