{"record":{"id":"af37fc3405248fe1","repo":"kubernetes/kops","slug":"error-listing-securitygroups-v-af37fc","errorCode":null,"errorMessage":"error listing SecurityGroups: %v","messagePattern":"error listing SecurityGroups: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygroup.go","lineNumber":123,"sourceCode":"\n\tif fi.ValueOf(e.ID) != \"\" {\n\t\t// Find by ID.\n\t\trequest.GroupIds = []string{fi.ValueOf(e.ID)}\n\t} else if fi.ValueOf(e.Name) != \"\" && e.VPC != nil && e.VPC.ID != nil {\n\t\t// Find by filters (name and VPC ID).\n\t\tfilters := cloud.BuildFilters(e.Name)\n\t\tfilters = append(filters, awsup.NewEC2Filter(\"vpc-id\", *e.VPC.ID))\n\t\tfilters = append(filters, awsup.NewEC2Filter(\"group-name\", *e.Name))\n\t\trequest.Filters = filters\n\n\t} else {\n\t\t// No reason to try.\n\t\treturn nil, nil\n\t}\n\n\tresponse, err := cloud.EC2().DescribeSecurityGroups(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing SecurityGroups: %v\", err)\n\t}\n\tif response == nil || len(response.SecurityGroups) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(response.SecurityGroups) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple SecurityGroups matching tags\")\n\t}\n\tsg := response.SecurityGroups[0]\n\treturn &sg, nil\n}\n\nfunc (e *SecurityGroup) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (_ *SecurityGroup) ShouldCreate(a, e, changes *SecurityGroup) (bool, error) {\n\tif fi.ValueOf(e.Shared) {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygroup.go#L105-L141","documentation":"Wraps an EC2 DescribeSecurityGroups API failure inside SecurityGroup.findEc2, which locates a cluster security group by tags. kOps cannot enumerate security groups so reconciliation of that task aborts.","triggerScenarios":"DescribeSecurityGroups call fails during Find or FindDeletions: throttling (RequestLimitExceeded), UnauthorizedOperation/AccessDenied, network/endpoint failures, or SDK timeouts.","commonSituations":"kOps instance profile missing ec2:DescribeSecurityGroups; VPC endpoint misconfigured; large clusters with many tasks exceeding EC2 rate limits; AWS regional outage.","solutions":["Check the wrapped AWS error code in the message","Add ec2:DescribeSecurityGroups to the kOps IAM policy if AccessDenied/UnauthorizedOperation","For throttling, re-run later or reduce concurrent task pressure","Verify network path to EC2 (NAT/VPC endpoint) in the target region"],"exampleFix":"{\"Effect\":\"Allow\",\"Action\":[\"ec2:DescribeSecurityGroups\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"aws ec2 describe-security-groups --filters Name=tag:kubernetes.io/cluster/<cluster>,Values=owned --region <region>","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"RequestLimitExceeded\") {\n  // back off, reduce concurrency, retry\n} else if err != nil && strings.Contains(err.Error(), \"UnauthorizedOperation\") {\n  // add ec2:DescribeSecurityGroups to IAM policy\n}","preventionTips":["Verify IAM describe permissions before large applies","Split very large clusters to reduce API burst rate","Check AWS health/dashboard on widespread API errors"],"tags":["aws","security-group","api-error","iam"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}