{"record":{"id":"d8d19696e75da413","repo":"kubernetes/kops","slug":"error-listing-hosted-zones-w","errorCode":null,"errorMessage":"error listing hosted zones: %w","messagePattern":"error listing hosted zones: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dnsprovider/pkg/dnsprovider/providers/aws/route53/zones.go","lineNumber":45,"sourceCode":"\t\"k8s.io/kops/dnsprovider/pkg/dnsprovider\"\n)\n\n// Compile time check for interface adherence\nvar _ dnsprovider.Zones = Zones{}\n\ntype Zones struct {\n\tinterface_ *Interface\n}\n\nfunc (zones Zones) List() ([]dnsprovider.Zone, error) {\n\tvar zoneList []dnsprovider.Zone\n\n\tinput := &route53.ListHostedZonesInput{}\n\tpaginator := route53.NewListHostedZonesPaginator(zones.interface_.service, input)\n\tfor paginator.HasMorePages() {\n\t\tpage, err := paginator.NextPage(context.TODO())\n\t\tif err != nil {\n\t\t\treturn []dnsprovider.Zone{}, fmt.Errorf(\"error listing hosted zones: %w\", err)\n\t\t}\n\t\tfor _, zone := range page.HostedZones {\n\t\t\tzoneList = append(zoneList, &Zone{&zone, &zones})\n\t\t}\n\t}\n\treturn zoneList, nil\n}\n\nfunc (zones Zones) Add(zone dnsprovider.Zone) (dnsprovider.Zone, error) {\n\tdnsName := zone.Name()\n\tcallerReference := string(uuid.NewUUID())\n\tinput := route53.CreateHostedZoneInput{Name: &dnsName, CallerReference: &callerReference}\n\toutput, err := zones.interface_.service.CreateHostedZone(context.TODO(), &input)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &Zone{output.HostedZone, &zones}, nil\n}","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/dnsprovider/pkg/dnsprovider/providers/aws/route53/zones.go#L27-L63","documentation":"Route53 Zones.List wraps a failure of the paginated ListHostedZonesPages API call. It fires when AWS rejects or errors on listing hosted zones — credentials, throttling, or connectivity — and propagates the AWS error via %w.","triggerScenarios":"Calling List() on the Route53 zones interface when ListHostedZones fails: AccessDenied on route53:ListHostedZones, throttling, invalid credentials, network error.","commonSituations":"IAM user/role without route53:ListHostedZones; credentials valid but scoped to another account with no zones access; SDK throttling on bursty callers.","solutions":["Grant route53:ListHostedZones to the calling identity if AccessDenied.","Check the wrapped error for throttling and add backoff/retry.","Verify credentials resolve to the intended AWS account (`aws sts get-caller-identity`).","Fix any network/proxy issues blocking route53.amazonaws.com."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify credentials + basic route53 access first\nout, err := exec.Command(\"aws\", \"sts\", \"get-caller-identity\").Output()\nif err != nil {\n    return fmt.Errorf(\"AWS credentials invalid: %w\", err)\n}\n_ = out","typeGuard":null,"tryCatchPattern":"zones, err := provider.Zones().List()\nif err != nil {\n    if strings.Contains(err.Error(), \"AccessDenied\") {\n        return fmt.Errorf(\"IAM needs route53:ListHostedZones: %w\", err)\n    }\n    if strings.Contains(err.Error(), \"Throttling\") {\n        time.Sleep(backoff) // then retry once\n    }\n    return err\n}","preventionTips":["Include route53:ListHostedZones in the caller's IAM policy.","Confirm the credentials resolve to the account that owns the zones.","Apply jittered backoff when listing repeatedly."],"tags":["aws","route53","iam"],"backgroundTag":"aws-api-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}