{"record":{"id":"b43e4e7d1ab12391","repo":"kubernetes/kops","slug":"found-multiple-securitygroups-matching-tags","errorCode":null,"errorMessage":"found multiple SecurityGroups matching tags","messagePattern":"found multiple SecurityGroups matching tags","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygroup.go","lineNumber":130,"sourceCode":"\t\tfilters = append(filters, awsup.NewEC2Filter(\"vpc-id\", *e.VPC.ID))\n\t\tfilters = append(filters, awsup.NewEC2Filter(\"group-name\", *e.Name))\n\t\trequest.Filters = filters\n\n\t} else {\n\t\t// No reason to try.\n\t\treturn nil, nil\n\t}\n\n\tresponse, err := cloud.EC2().DescribeSecurityGroups(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing SecurityGroups: %v\", err)\n\t}\n\tif response == nil || len(response.SecurityGroups) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(response.SecurityGroups) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple SecurityGroups matching tags\")\n\t}\n\tsg := response.SecurityGroups[0]\n\treturn &sg, nil\n}\n\nfunc (e *SecurityGroup) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (_ *SecurityGroup) ShouldCreate(a, e, changes *SecurityGroup) (bool, error) {\n\tif fi.ValueOf(e.Shared) {\n\t\treturn false, nil\n\t}\n\treturn true, nil\n}\n\nfunc (_ *SecurityGroup) CheckChanges(a, e, changes *SecurityGroup) error {\n\tif a != nil {","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygroup.go#L112-L148","documentation":"findEc2 located more than one EC2 SecurityGroup matching the name/tag filters within the VPC; kOps expects a unique match for idempotent lookups and refuses to pick between them.","triggerScenarios":"DescribeSecurityGroups with the task's tag filters returns 2+ security groups during Find/FindDeletions — duplicate groups sharing kOps's tag key/value (e.g., same Name tag like 'nodes.cluster.example.com').","commonSituations":"Security groups manually copied/cloned in the console retaining kOps tags; failed previous apply left a duplicate before tags were fixed; importing an existing cluster where SGs were duplicated; shared VPC where another team's SG has identical tags.","solutions":["List SGs with the duplicated tags: aws ec2 describe-security-groups --filters Name=tag:kubernetes.io/cluster/<cluster>,Values=owned","Delete or re-tag the extraneous duplicate security group","Keep kOps tag names unique per cluster; avoid cloning kops-managed SGs","Re-run kops update to confirm reconciliation succeeds"],"exampleFix":"aws ec2 delete-security-group --group-id <duplicate-sg-id>","handlingStrategy":"validation","validationCode":"aws ec2 describe-security-groups --filters Name=tag:kubernetes.io/cluster/<cluster>,Values=owned --query 'length(SecurityGroups)' # expect 1 per role","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never clone or copy kops-managed security groups","Keep kops cluster tags unique per cluster (kubernetes.io/cluster/<name>)","Reconcile imported clusters so kOps owns exactly one SG per task role"],"tags":["aws","security-group","tags","conflict"],"backgroundTag":"multiple-security-groups-matching-tags","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}