{"record":{"id":"d36b4f5b8a87f979","repo":"kubernetes/kops","slug":"error-creating-securitygroupegress-v","errorCode":null,"errorMessage":"error creating SecurityGroupEgress: %v","messagePattern":"error creating SecurityGroupEgress: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygrouprule.go","lineNumber":320,"sourceCode":"\t\t} else {\n\t\t\tipPermission.IpRanges = []ec2types.IpRange{\n\t\t\t\t{CidrIp: aws.String(\"0.0.0.0/0\")},\n\t\t\t}\n\t\t}\n\n\t\tdescription := e.Description()\n\n\t\tif fi.ValueOf(e.Egress) {\n\t\t\trequest := &ec2.AuthorizeSecurityGroupEgressInput{\n\t\t\t\tGroupId: e.SecurityGroup.ID,\n\t\t\t}\n\t\t\trequest.IpPermissions = []ec2types.IpPermission{ipPermission}\n\t\t\trequest.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)\n\n\t\t\tklog.V(2).Infof(\"%s: Calling EC2 AuthorizeSecurityGroupEgress (%s)\", name, description)\n\t\t\t_, err := t.Cloud.EC2().AuthorizeSecurityGroupEgress(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error creating SecurityGroupEgress: %v\", err)\n\t\t\t}\n\t\t} else {\n\t\t\trequest := &ec2.AuthorizeSecurityGroupIngressInput{\n\t\t\t\tGroupId: e.SecurityGroup.ID,\n\t\t\t}\n\t\t\trequest.IpPermissions = []ec2types.IpPermission{ipPermission}\n\t\t\trequest.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)\n\n\t\t\tklog.V(2).Infof(\"%s: Calling EC2 AuthorizeSecurityGroupIngress (%s)\", name, description)\n\t\t\t_, err := t.Cloud.EC2().AuthorizeSecurityGroupIngress(ctx, request)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error creating SecurityGroupIngress: %v\", err)\n\t\t\t}\n\t\t}\n\n\t} else if changes.Tags != nil {\n\t\treturn t.AddAWSTags(*a.ID, e.Tags)\n\t}","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygrouprule.go#L302-L338","documentation":"RenderAWS (creation path, a==nil) calls AuthorizeSecurityGroupEgress to create a new egress rule on the security group, including tag specifications, and wraps any AWS failure here. Raised when the SecurityGroupRule task is new and Egress is true.","triggerScenarios":"First-time creation or re-creation of an egress rule where AuthorizeSecurityGroupEgress fails: InvalidGroup.NotFound (SG deleted mid-apply), InvalidParameterValue (malformed CIDR/prefix-list/pl- id, bad IPv6 CIDR), missing source group, throttling, AccessDenied on ec2:AuthorizeSecurityGroupEgress.","commonSituations":"Typo'd CIDR in cluster spec (e.g. missing '/' in 10.0.0.0/8); prefix-list id deleted in AWS; SG removed by another tool while kops applies; IAM policy without the authorize action; rules referencing an out-of-region or cross-account group without permission.","solutions":["Read the wrapped AWS error: InvalidParameterValue → fix CIDR/IPv6CIDR/PrefixList in the cluster spec; InvalidGroup.NotFound → recreate the SG; AccessDenied → fix IAM","Validate the CIDR syntax (e.g. `10.0.0.0/8`, `::/0`) and that prefix lists start with `pl-` and exist in the region","Confirm ec2:AuthorizeSecurityGroupEgress permission and valid credentials","Re-run `kops update cluster --yes` if the failure was transient (throttling)"],"exampleFix":"// before (spec)\ncidr: 10.0.0.0\n// after\ncidr: 10.0.0.0/8","handlingStrategy":"validation","validationCode":"// Validate CIDR/IPv6/prefix-list inputs before applying:\nimport \"net\"\nfunc validCIDR(s string) bool { _, _, err := net.ParseCIDR(s); return err == nil }\nfunc validPrefixList(s string) bool { return strings.HasPrefix(s, \"pl-\") }\n// Ensure the SG exists: aws ec2 describe-security-groups --group-ids $SG_ID","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n  if strings.Contains(err.Error(), \"error creating SecurityGroupEgress\") {\n    // InvalidParameterValue → fix CIDR; InvalidGroup.NotFound → recreate SG; AccessDenied → IAM\n    log.Println(err)\n  }\n}","preventionTips":["Double-check CIDR notation in specs (netmask present, valid IPv6 form)","Don't delete kops-managed SGs out-of-band mid-apply","Grant ec2:AuthorizeSecurityGroupEgress to the automation role","Verify prefix lists (pl-*) exist in the target region"],"tags":["aws","ec2","security-group","egress","authorize-api"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}