{"record":{"id":"b7af79df66a8595f","repo":"kubernetes/kops","slug":"error-attaching-internetgateway-to-vpc-v","errorCode":null,"errorMessage":"error attaching InternetGateway to VPC: %v","messagePattern":"error attaching InternetGateway to VPC: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/internetgateway.go","lineNumber":178,"sourceCode":"\t\tresponse, err := t.Cloud.EC2().CreateInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating InternetGateway: %v\", err)\n\t\t}\n\n\t\te.ID = response.InternetGateway.InternetGatewayId\n\t}\n\n\tif a == nil || (changes != nil && changes.VPC != nil) {\n\t\tklog.V(2).Infof(\"Creating InternetGatewayAttachment\")\n\n\t\tattachRequest := &ec2.AttachInternetGatewayInput{\n\t\t\tVpcId:             e.VPC.ID,\n\t\t\tInternetGatewayId: e.ID,\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().AttachInternetGateway(ctx, attachRequest)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error attaching InternetGateway to VPC: %v\", err)\n\t\t}\n\t}\n\n\treturn t.AddAWSTags(*e.ID, e.Tags)\n}\n\ntype terraformInternetGateway struct {\n\tVPCID *terraformWriter.Literal `cty:\"vpc_id\"`\n\tTags  map[string]string        `cty:\"tags\"`\n}\n\nfunc (_ *InternetGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *InternetGateway) error {\n\tctx := context.TODO()\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\t// Not terraform owned / managed\n\n\t\t// But ... attempt to discover the ID so TerraformLink works","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/internetgateway.go#L160-L196","documentation":"This error wraps a failure from the AWS EC2 AttachInternetGateway API call while applying an InternetGateway task against a VPC during kOps' AWS reconciliation (RenderAWS). It means AWS refused (or the call failed) to attach the internet gateway to the target VPC. kOps surfaces the underlying EC2 error message via %v so the real cause is in the wrapped error.","triggerScenarios":"Calling RenderAWS on an internetgateway task whose e.ID is set and whose attachment state changed, where AttachInternetGateway returns an error - e.g. the IGW is already attached to a different VPC, the VPC ID is wrong/deleted, throttling, or invalid permission on the account.","commonSituations":"Reusing a shared internet gateway that is already attached to another VPC (an IGW can attach to only one VPC); a stale VPC reference after cluster recreation; AWS API throttling during large reconciliations; IAM policy denying ec2:AttachInternetGateway.","solutions":["Check the wrapped AWS error: if 'already attached', detach the IGW from the other VPC or create a new IGW for this VPC.","Verify the VPC ID referenced by the task (e.VPC.ID) exists and matches the intended cluster VPC.","Ensure the IAM role/policy used by kOps includes ec2:AttachInternetGateway.","Retry the apply if the error was transient (throttling: RequestLimitExceeded)."],"exampleFix":"// before: IGW shared/attached elsewhere\nIGW already attached to vpc-old\n// after\ndetach from vpc-old (or create a new InternetGateway task) and re-run kops update cluster","handlingStrategy":"retry","validationCode":"// before apply\naws ec2 describe-internet-gateways --filters Name=attachment.vpc-id,Values=$VPC_ID\n// ensure the IGW is not already attached elsewhere and the VPC exists\naws ec2 describe-vpcs --vpc-ids $VPC_ID","typeGuard":null,"tryCatchPattern":"err := runKopsUpdate(); if err != nil && strings.Contains(err.Error(), \"error attaching InternetGateway\") { detach IGW from other VPC or recreate IGW task, then retry once }","preventionTips":["Never share one IGW across cluster VPCs; one IGW per VPC.","Verify VPC ID in the cluster spec matches an existing VPC before applying.","Include ec2:AttachInternetGateway in the kops IAM policy.","Add backoff/retry for RequestLimitExceeded during applies."],"tags":["aws","ec2","internet-gateway","vpc","networking"],"backgroundTag":"internet-gateway-attach-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}