{"record":{"id":"b62288859e8c7eaa","repo":"kubernetes/kops","slug":"error-describing-routetables-v","errorCode":null,"errorMessage":"error describing RouteTables: %v","messagePattern":"error describing RouteTables: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":836,"sourceCode":"\n\t\tfor _, address := range response.Addresses {\n\t\t\tip := aws.ToString(address.PublicIp)\n\t\t\tif !elasticIPs.Has(ip) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tresourceTrackers = append(resourceTrackers, buildElasticIPResource(address, ownedElasticIPs.Has(ip), clusterName))\n\t\t}\n\t}\n\n\t// Associated Nat Gateways\n\t// Note: we must not delete any shared NAT Gateways here.\n\t// Since we don't have tagging on the NGWs, we have to read the route tables\n\tif natGatewayIds.Len() != 0 {\n\n\t\trtRequest := &ec2.DescribeRouteTablesInput{}\n\t\trtResponse, err := c.EC2().DescribeRouteTables(ctx, rtRequest)\n\t\tif err != nil && awsup.AWSErrorCode(err) != \"InvalidRouteTableID.NotFound\" {\n\t\t\treturn nil, fmt.Errorf(\"error describing RouteTables: %v\", err)\n\t\t}\n\t\t// sharedNgwIds is the set of IDs for shared NGWs, that we should not delete\n\t\tsharedNgwIds := sets.NewString()\n\t\tif rtResponse != nil {\n\t\t\tfor _, rt := range rtResponse.RouteTables {\n\t\t\t\tfor _, t := range rt.Tags {\n\t\t\t\t\tk := aws.ToString(t.Key)\n\t\t\t\t\tv := aws.ToString(t.Value)\n\n\t\t\t\t\tif k == \"AssociatedNatgateway\" {\n\t\t\t\t\t\tsharedNgwIds.Insert(v)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tklog.V(2).Infof(\"Querying Nat Gateways\")\n\t\trequest := &ec2.DescribeNatGatewaysInput{}","sourceCodeStart":818,"sourceCodeEnd":854,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L818-L854","documentation":"ListSubnets describes all route tables (to find NGWs tagged for shared subnets, since NGWs themselves are untagged) and returns this error for any DescribeRouteTables failure except InvalidRouteTableID.NotFound. It means route table enumeration failed, so shared NAT gateway detection cannot proceed.","triggerScenarios":"ec2.DescribeRouteTables fails with anything other than InvalidRouteTableID.NotFound: UnauthorizedOperation/AuthFailure, RequestLimitExceeded throttling, invalid credentials, or network failure.","commonSituations":"Custom IAM policies omitting ec2:DescribeRouteTables; large multi-account setups hitting throttling; broken VPC endpoint configuration blocking EC2 API calls.","solutions":["Grant ec2:DescribeRouteTables in the caller's IAM policy.","Retry with exponential backoff on throttling errors.","Validate credentials and the configured region.","Check VPC endpoint/proxy connectivity to EC2."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"perms, _ := iamSimulatePrincipalPolicy(ctx, \"ec2:DescribeRouteTables\")\nif !perms.Allowed { return fmt.Errorf(\"IAM lacks ec2:DescribeRouteTables\") }","typeGuard":"func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == \"UnauthorizedOperation\" || ae.ErrorCode() == \"AccessDenied\") }","tryCatchPattern":"if err != nil {\n  if isAuthError(err) { return fmt.Errorf(\"grant ec2:DescribeRouteTables: %w\", err) }\n  if isThrottling(err) { return backoffRetry() }\n  return err\n}","preventionTips":["Ensure the kops IAM policy includes ec2:DescribeRouteTables.","Check VPC endpoint policies allow ec2 API calls from private subnets.","Add retries with jitter for route table reads in automation.","Validate region configuration matches cluster location."],"tags":["aws","ec2","route-table","nat-gateway","api-error"],"backgroundTag":"aws-credentials-or-iam-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}