{"record":{"id":"dd02411d9a25322d","repo":"kubernetes/kops","slug":"error-listing-sqs-queues-v","errorCode":null,"errorMessage":"error listing SQS queues: %v","messagePattern":"error listing SQS queues: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/sqs.go","lineNumber":73,"sourceCode":"\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"error deleting SQS queue %q: %w\", url, err)\n\t}\n\treturn nil\n}\n\nfunc ListSQSQueues(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\tc := cloud.(awsup.AWSCloud)\n\n\tklog.V(2).Infof(\"Listing SQS queues\")\n\tqueuePrefix := strings.ReplaceAll(clusterName, \".\", \"-\")\n\n\trequest := &sqs.ListQueuesInput{\n\t\tQueueNamePrefix: &queuePrefix,\n\t}\n\tresponse, err := c.SQS().ListQueues(context.TODO(), request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing SQS queues: %v\", err)\n\t}\n\tif response == nil || len(response.QueueUrls) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\n\tfor _, queueUrl := range response.QueueUrls {\n\t\tresourceTracker := &resources.Resource{\n\t\t\tName:    queueUrl,\n\t\t\tID:      queueUrl,\n\t\t\tType:    \"sqs\",\n\t\t\tDeleter: DeleteSQSQueue,\n\t\t\tDumper:  DumpSQSQueue,\n\t\t\tObj:     queueUrl,\n\t\t}\n\n\t\tresourceTrackers = append(resourceTrackers, resourceTracker)","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/sqs.go#L55-L91","documentation":"ListSQSQueues in pkg/resources/aws/sqs.go calls SQS ListQueues with QueueNamePrefix = clusterName with dots replaced by dashes, wrapping any API failure with this message. It is the discovery step for cluster SQS queues during deletion, so failure prevents cleanup of those queues.","triggerScenarios":"SQS ListQueues returning errors: AccessDenied (sqs:ListQueues not granted), RequestThrottled from account-level rate limits, AuthFailure/InvalidClientTokenId from bad credentials or wrong region, or network failures. Note: an empty prefix match is not an error (returns nil, nil).","commonSituations":"IAM policies granting only queue-level SQS actions but not sqs:ListQueues at account level; expired credentials mid-long deletion run; heavy throttling on accounts with very high SQS traffic; misconfigured region causing auth errors.","solutions":["Grant sqs:ListQueues at the account/region level in the IAM policy.","Check credentials and region configuration of the AWSCloud client.","Retry with backoff on RequestThrottled.","Verify network reachability to the regional SQS endpoint."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight: confirm SQS is reachable and credentials valid\nident, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})\nif err != nil { return fmt.Errorf(\"bad AWS credentials: %w\", err) }\n_ = ident","typeGuard":"func isSQSAccessDenied(err error) bool {\n    return err != nil && (awsup.AWSErrorCode(err) == \"AccessDenied\" || strings.Contains(err.Error(), \"UnauthorizedOperation\"))\n}","tryCatchPattern":"queues, err := ListSQSQueues(cloud, vpcID, clusterName)\nif err != nil {\n    if isSQSAccessDenied(err) { klog.Warningf(\"skip SQS cleanup (no sqs:ListQueues): %v\", err); queues = nil }\n    else { return nil, err }\n}","preventionTips":["Grant account-level sqs:ListQueues in cleanup automation policies.","Set the region explicitly; ListQueues is regional.","Retry throttled ListQueues calls with exponential backoff.","Refresh credentials before long multi-resource deletion runs."],"tags":["aws","sqs","list-queues","iam"],"backgroundTag":"aws-api-list-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}