{"record":{"id":"ded0eb78260f5164","repo":"kubernetes/kops","slug":"error-adding-aws-tags-to-ebs-volume-v","errorCode":null,"errorMessage":"error adding AWS Tags to EBS Volume: %v","messagePattern":"error adding AWS Tags to EBS Volume: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/ebsvolume.go","lineNumber":161,"sourceCode":"\t\t\tAvailabilityZone:  e.AvailabilityZone,\n\t\t\tVolumeType:        e.VolumeType,\n\t\t\tKmsKeyId:          e.KmsKeyId,\n\t\t\tEncrypted:         e.Encrypted,\n\t\t\tIops:              e.VolumeIops,\n\t\t\tThroughput:        e.VolumeThroughput,\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVolume, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateVolume(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating PersistentVolume: %v\", err)\n\t\t}\n\n\t\te.ID = response.VolumeId\n\t}\n\n\tif err := t.AddAWSTags(*e.ID, e.Tags); err != nil {\n\t\treturn fmt.Errorf(\"error adding AWS Tags to EBS Volume: %v\", err)\n\t}\n\n\tif a != nil {\n\t\tif len(changes.Tags) > 0 {\n\t\t\ttagsToDelete := e.getEBSVolumeTagsToDelete(a.Tags)\n\t\t\tif len(tagsToDelete) > 0 {\n\t\t\t\treturn t.DeleteTags(*e.ID, tagsToDelete)\n\t\t\t}\n\t\t}\n\n\t\tif len(changes.VolumeType) > 0 ||\n\t\t\tchanges.VolumeIops != nil ||\n\t\t\tchanges.VolumeThroughput != nil ||\n\t\t\tchanges.SizeGB != nil {\n\n\t\t\trequest := &ec2.ModifyVolumeInput{\n\t\t\t\tVolumeId:   a.ID,\n\t\t\t\tVolumeType: e.VolumeType,","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/ebsvolume.go#L143-L179","documentation":"After creating or finding the EBS volume, RenderAWS applies the required tags via AddAWSTags (CreateTags API); a failure here aborts the task. Untagged volumes break kOps' tag-based discovery in Find(), so this is treated as fatal rather than a warning.","triggerScenarios":"AddAWSTags fails during RenderAWS — typically missing ec2:CreateTags permission, invalid tag key/value characters, or the volume was deleted concurrently between creation and tagging.","commonSituations":"IAM policies lacking ec2:CreateTags; tag values containing characters AWS rejects; very large numbers of tags exceeding AWS limits.","solutions":["Grant ec2:CreateTags in the IAM policy","Validate tag keys/values against AWS tag constraints (length, allowed characters)","Re-run `kops update cluster` to retry tagging","Check whether the volume ID still exists (concurrent deletion)"],"exampleFix":"// before (IAM)\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:CreateVolume\"],\"Resource\":\"*\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:CreateVolume\",\"ec2:CreateTags\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"_, err := iamSimulate(iamClient, roleArn, \"ec2:CreateTags\")\nif err != nil { return fmt.Errorf(\"IAM missing ec2:CreateTags: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err := t.AddAWSTags(*e.ID, e.Tags); err != nil {\n    var aerr smithy.APIError\n    if errors.As(err, &aerr) && aerr.ErrorCode() == \"InvalidParameterValue\" {\n        // validate tag chars/length before retry\n    }\n    return fmt.Errorf(\"error adding AWS Tags to EBS Volume: %w\", err)\n}","preventionTips":["Grant ec2:CreateTags to kOps IAM role","Constrain tag keys/values to AWS limits (<=256 chars, allowed charset)","Keep tag counts under AWS per-resource limits"],"tags":["aws","ec2","ebs","tags","iam"],"backgroundTag":"aws-tagging-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}