{"record":{"id":"c4eb5a0b04523666","repo":"kubernetes/kops","slug":"error-querying-tags-for-elasticip-v","errorCode":null,"errorMessage":"error querying tags for ElasticIP: %v","messagePattern":"error querying tags for ElasticIP: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/elastic_ip.go","lineNumber":164,"sourceCode":"\t\ta := response.Addresses[0]\n\t\tactual := &ElasticIP{\n\t\t\tID:       a.AllocationId,\n\t\t\tPublicIP: a.PublicIp,\n\t\t}\n\t\tactual.TagOnSubnet = e.TagOnSubnet\n\t\tactual.AssociatedNatGatewayRouteTable = e.AssociatedNatGatewayRouteTable\n\n\t\t{\n\t\t\ttags, err := cloud.EC2().DescribeTags(ctx, &ec2.DescribeTagsInput{\n\t\t\t\tFilters: []ec2types.Filter{\n\t\t\t\t\t{\n\t\t\t\t\t\tName:   aws.String(\"resource-id\"),\n\t\t\t\t\t\tValues: []string{aws.ToString(a.AllocationId)},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error querying tags for ElasticIP: %v\", err)\n\t\t\t}\n\t\t\tvar ec2Tags []ec2types.Tag\n\t\t\tfor _, t := range tags.Tags {\n\t\t\t\tec2Tags = append(ec2Tags, ec2types.Tag{\n\t\t\t\t\tKey:   t.Key,\n\t\t\t\t\tValue: t.Value,\n\t\t\t\t})\n\t\t\t}\n\t\t\tactual.Tags = intersectTags(ec2Tags, e.Tags)\n\t\t}\n\n\t\t// ElasticIP don't have a Name (no tags), so we set the name to avoid spurious changes\n\t\tactual.Name = e.Name\n\n\t\te.ID = actual.ID\n\n\t\t// Avoid spurious changes\n\t\tactual.Lifecycle = e.Lifecycle","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/elastic_ip.go#L146-L182","documentation":"After resolving the address, find() calls EC2 DescribeTags filtered by resource-id = allocationId to read the EIP's tags for diffing. If DescribeTags errors, it is wrapped as 'error querying tags for ElasticIP: %v'. The address itself was found; only the tag-read step failed.","triggerScenarios":"ec2.DescribeTags fails for the EIP's allocation ID: throttling (DescribeTags is a high-volume API), IAM policy denying ec2:DescribeTags, transient AWS API/network errors, or a malformed allocation ID string used as the resource-id filter.","commonSituations":"Strictly scoped IAM policies (kops least-privilege docs omit ec2:DescribeTags); large clusters where DescribeTags throttles; temporary AWS API outages during `kops update cluster`.","solutions":["Add ec2:DescribeTags to the IAM policy used by kops and re-run kops update cluster","Retry; if throttling, back off / request an EC2 API rate-limit increase","Verify the allocation ID is a valid eipalloc-* string (an invalid filter value causes a filter-limit/mismatch error)","Check AWS health dashboard for EC2 API issues in the region"],"exampleFix":"// before: policy missing tag read\n{\"Effect\":\"Deny\"} // ec2:DescribeTags absent\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:DescribeTags\"],\"Resource\":\"*\"}","handlingStrategy":"retry","validationCode":"// ensure IAM permissions before running\nactions := []string{\"ec2:DescribeTags\"}\n// simulate with iam-simulator or aws iam simulate-principal-policy","typeGuard":null,"tryCatchPattern":"var ae smithy.APIError\nif errors.As(err, &ae) {\n    switch ae.ErrorCode() {\n    case \"ThrottlingException\": // exponential backoff retry\n    case \"AccessDenied\": // fix IAM policy\n    }\n}","preventionTips":["Include ec2:DescribeTags in kops IAM policies","Apply exponential backoff for DescribeTags throttling","Check AWS health for regional API outages before large updates","Validate allocation IDs are well-formed eipalloc-* strings"],"tags":["aws","ec2","tags","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}