{"record":{"id":"b915eb4e4d4520b8","repo":"kubernetes/kops","slug":"error-listing-securitygroups-v","errorCode":null,"errorMessage":"error listing SecurityGroups: %v","messagePattern":"error listing SecurityGroups: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/securitygroup.go","lineNumber":160,"sourceCode":"\t\tresourceTrackers = append(resourceTrackers, resourceTracker)\n\t}\n\n\treturn resourceTrackers, nil\n}\n\nfunc DescribeSecurityGroups(cloud fi.Cloud, clusterName string) (map[string]ec2types.SecurityGroup, error) {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\n\tgroups := make(map[string]ec2types.SecurityGroup)\n\tklog.V(2).Infof(\"Listing EC2 SecurityGroups\")\n\tfor _, filters := range buildEC2FiltersForCluster(clusterName) {\n\t\trequest := &ec2.DescribeSecurityGroupsInput{\n\t\t\tFilters: filters,\n\t\t}\n\t\tresponse, err := c.EC2().DescribeSecurityGroups(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing SecurityGroups: %v\", err)\n\t\t}\n\n\t\tfor _, group := range response.SecurityGroups {\n\t\t\tgroups[aws.ToString(group.GroupId)] = group\n\t\t}\n\t}\n\n\treturn groups, nil\n}\n","sourceCodeStart":142,"sourceCodeEnd":170,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/securitygroup.go#L142-L170","documentation":"DescribeSecurityGroups in pkg/resources/aws/securitygroup.go calls EC2 DescribeSecurityGroups once per cluster-tag filter set (owned + shared) and wraps any API error with this message. It is the inventory step used by ListSecurityGroups during cluster deletion/dump, so a failure prevents discovery of cluster security groups.","triggerScenarios":"ec2.DescribeSecurityGroups with cluster-tag Filters returning UnauthorizedOperation (missing ec2:DescribeSecurityGroups), InvalidFilter values (e.g. bad tag key), RequestLimitExceeded throttling, invalid credentials, or network failures.","commonSituations":"Least-privilege IAM missing DescribeSecurityGroups; running kOps with an expired SSO/STS session; throttling when many resource types are listed concurrently; tag filter mismatch is not the cause here (that yields empty results, not an error).","solutions":["Ensure IAM grants ec2:DescribeSecurityGroups.","Verify credentials/session and target region match the cluster.","Back off and retry on RequestLimitExceeded / throttling.","Check network connectivity to the EC2 endpoint (VPC endpoint, proxy, DNS)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight describe access\n_, err := ec2Client.DescribeSecurityGroups(ctx, &ec2.DescribeSecurityGroupsInput{MaxResults: aws.Int32(1)})\nif err != nil { return fmt.Errorf(\"ec2:DescribeSecurityGroups preflight failed: %w\", err) }","typeGuard":"func isThrottlingErr(err error) bool {\n    c := awsup.AWSErrorCode(err)\n    return c == \"RequestLimitExceeded\" || c == \"Throttling\" || c == \"RequestThrottled\"\n}","tryCatchPattern":"groups, err := DescribeSecurityGroups(cloud, clusterName)\nif err != nil {\n    if isThrottlingErr(err) { time.Sleep(backoff); groups, err = DescribeSecurityGroups(cloud, clusterName) }\n    if err != nil { return nil, err }\n}","preventionTips":["Include ec2:DescribeSecurityGroups in automation IAM policies.","Refresh STS/SSO sessions before long-running deletion jobs.","Stagger concurrent kops operations to avoid EC2 rate limits.","Verify region correctness before running cluster-wide discovery."],"tags":["aws","ec2","security-group","iam","throttling"],"backgroundTag":"aws-api-list-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}