{"record":{"id":"c132a2ed644f7e07","repo":"kubernetes/kops","slug":"error-listing-securitygroup-v","errorCode":null,"errorMessage":"error listing SecurityGroup: %v","messagePattern":"error listing SecurityGroup: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygrouprule.go","lineNumber":80,"sourceCode":"\n\tif e.SecurityGroup == nil || e.SecurityGroup.ID == nil {\n\t\treturn nil, nil\n\t}\n\n\tif e.SourceGroup != nil && e.SourceGroup.ID == nil {\n\t\tklog.V(4).Infof(\"Skipping find of SecurityGroupRule %s, because SourceGroup was not found\", fi.ValueOf(e.Name))\n\t\treturn nil, nil\n\t}\n\n\trequest := &ec2.DescribeSecurityGroupRulesInput{\n\t\tFilters: []ec2types.Filter{\n\t\t\tawsup.NewEC2Filter(\"group-id\", *e.SecurityGroup.ID),\n\t\t},\n\t}\n\n\tresponse, err := cloud.EC2().DescribeSecurityGroupRules(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing SecurityGroup: %v\", err)\n\t}\n\n\tif response == nil || len(response.SecurityGroupRules) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tvar foundRule *ec2types.SecurityGroupRule\n\n\tfor _, rule := range response.SecurityGroupRules {\n\t\tif e.matches(&rule) {\n\t\t\tfoundRule = &rule\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif foundRule != nil {\n\t\tactual := &SecurityGroupRule{\n\t\t\tID:            foundRule.SecurityGroupRuleId,","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygrouprule.go#L62-L98","documentation":"SecurityGroupRule.Find calls EC2 DescribeSecurityGroupRules (filtered by group-id) to locate the existing rule for delta computation, and wraps any API failure here. Note the message says 'listing SecurityGroup' but it is the rule-describe call that failed. This aborts the Find phase for the rule task.","triggerScenarios":"DescribeSecurityGroupRules fails during `kops update/replace`: auth failure (InvalidClientTokenId, expired credentials), AccessDenied on ec2:DescribeSecurityGroupRules, throttling (RequestLimitExceeded on large clusters with many rules), or InvalidGroup.NotFound if the referenced SG was deleted out-of-band.","commonSituations":"Old/rotated AWS credentials in env or state-store config; IAM policy missing the newer DescribeSecurityGroupRules action (introduced with SG rule IDs, 2021); region misconfiguration; applying huge clusters hitting EC2 rate limits.","solutions":["Verify credentials/region (`aws sts get-caller-identity` in the same profile) and re-run kops","Add ec2:DescribeSecurityGroupRules to the IAM policy — older minimal EC2 policies lack it","Read the wrapped AWS error: AccessDenied → IAM fix; RequestLimitExceeded → retry / reduce parallelism; InvalidGroup.NotFound → reconcile the security group first","Retry `kops update cluster` after the transient condition clears"],"exampleFix":"// before (IAM policy)\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:DescribeSecurityGroups\"],\"Resource\":\"*\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:DescribeSecurityGroups\",\"ec2:DescribeSecurityGroupRules\"],\"Resource\":\"*\"}","handlingStrategy":"retry","validationCode":"// Pre-flight the AWS identity and permission:\naws sts get-caller-identity\naws ec2 describe-security-group-rules --max-items 1  # fails fast if ec2:DescribeSecurityGroupRules is missing","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n  if strings.Contains(err.Error(), \"error listing SecurityGroup\") {\n    // inspect wrapped cause: AccessDenied→IAM, RequestLimitExceeded→backoff+retry,\n    // InvalidClientTokenId→refresh credentials\n    log.Println(err)\n  }\n}","preventionTips":["Include ec2:DescribeSecurityGroupRules in the IAM policy (newer action, often missing from old policies)","Rotate/refresh AWS credentials before long apply sessions","Back off on throttling for large clusters with many rules","Pin the correct AWS region/profile for the cluster"],"tags":["aws","ec2","security-group","describe-api","iam"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}