{"record":{"id":"c9e72f3f0a418fc1","repo":"kubernetes/kops","slug":"error-associating-vpc-with-hosted-zone-q-v","errorCode":null,"errorMessage":"error associating VPC with hosted zone %q: %v","messagePattern":"error associating VPC with hosted zone %q: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dnszone.go","lineNumber":216,"sourceCode":"\n\t\te.ZoneID = response.HostedZone.Id\n\t} else {\n\t\tif changes.PrivateVPC != nil {\n\t\t\trequest := &route53.AssociateVPCWithHostedZoneInput{\n\t\t\t\tHostedZoneId: a.ZoneID,\n\t\t\t\tVPC: &route53types.VPC{\n\t\t\t\t\tVPCId:     e.PrivateVPC.ID,\n\t\t\t\t\tVPCRegion: route53types.VPCRegion(t.Cloud.Region()),\n\t\t\t\t},\n\t\t\t}\n\n\t\t\tchanges.PrivateVPC = nil\n\n\t\t\tklog.V(2).Infof(\"Updating DNSZone %q\", name)\n\n\t\t\t_, err := t.Cloud.Route53().AssociateVPCWithHostedZone(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error associating VPC with hosted zone %q: %v\", name, err)\n\t\t\t}\n\t\t}\n\n\t\tempty := &DNSZone{}\n\t\tif !reflect.DeepEqual(empty, changes) {\n\t\t\tklog.Warningf(\"cannot apply changes to DNSZone %q: %v\", name, changes)\n\t\t}\n\t}\n\n\t// We don't tag the zone - we expect it to be shared\n\treturn nil\n}\n\ntype terraformRoute53ZoneAssociation struct {\n\tZoneID    *terraformWriter.Literal `cty:\"zone_id\"`\n\tVPCID     *terraformWriter.Literal `cty:\"vpc_id\"`\n\tLifecycle *terraform.Lifecycle     `cty:\"lifecycle\"`\n}","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dnszone.go#L198-L234","documentation":"kOps' DNSZone task failed to associate a VPC with an existing private Route53 hosted zone while applying AWS changes. kOps calls Route53's AssociateVPCWithHostedZone when a private zone's VPC associations need updating; any AWS API rejection is wrapped in this error. It indicates the zone will not be resolvable from the cluster's VPC as intended.","triggerScenarios":"RenderAWS on a private DNSZone when changes.PrivateVPC is set and the AssociateVPCWithHostedZone call returns an error — e.g. wrong hosted zone ID, zone not actually private, VPC ID/region mismatch, or IAM permissions missing route53:AssociateVPCWithHostedZone.","commonSituations":"Creating/updating private clusters where the hosted zone was pre-created externally with a different VPC association; credentials lacking Route53 permissions; zone hosted in a different region account than the VPC.","solutions":["Verify the IAM policy grants route53:AssociateVPCWithHostedZone on the zone","Confirm the hosted zone ID in the cluster spec points to a private zone in the same account as the VPC","Check the VPC ID and region in the cluster spec match an existing VPC","Run with klog V(2) to see the underlying AWS error detail and act on it"],"exampleFix":"// before (IAM policy missing route53:AssociateVPCWithHostedZone)\n{\"Effect\":\"Deny\",\"Action\":[\"route53:ChangeResourceRecordSets\"],\"Resource\":\"*\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"route53:AssociateVPCWithHostedZone\",\"route53:ChangeResourceRecordSets\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// Pre-check zone and permissions\nsvc := route53.NewFromClient(cfg)\nzone, err := svc.GetHostedZone(ctx, &route53.GetHostedZoneInput{Id: aws.String(zoneID)})\nif err != nil { return err }\nif zone.HostedZone.Config == nil || !aws.ToBool(zone.HostedZone.Config.PrivateZone) {\n    return fmt.Errorf(\"zone %s is not private\", zoneID)\n}","typeGuard":"func isAssociationErr(err error) bool { return err != nil && strings.Contains(err.Error(), \"AssociateVPCWithHostedZone\") }","tryCatchPattern":"_, err := cloud.Route53().AssociateVPCWithHostedZone(ctx, request)\nif err != nil {\n    var opErr *smithy.OperationError\n    if errors.As(err, &opErr) { klog.Errorf(\"route53 op failed: %v\", opErr.Unwrap()) }\n    return fmt.Errorf(\"error associating VPC with hosted zone %q: %w\", name, err)\n}","preventionTips":["Ensure IAM includes route53:AssociateVPCWithHostedZone","Confirm the zone is private before relying on VPC association","Match the VPC region/account with the zone's account"],"tags":["aws","route53","dns","vpc"],"backgroundTag":"vpc-hostedzone-association-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}