{"record":{"id":"e3829ac8009cf592","repo":"kubernetes/kops","slug":"error-listing-subnets-v","errorCode":null,"errorMessage":"error listing subnets: %v","messagePattern":"error listing subnets: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":760,"sourceCode":"\t_, err := c.EC2().DeleteSubnet(ctx, request)\n\tif err != nil {\n\t\tif awsup.AWSErrorCode(err) == \"InvalidSubnetID.NotFound\" {\n\t\t\tklog.V(2).Infof(\"Got InvalidSubnetID.NotFound error deleting subnet %q; will treat as already-deleted\", id)\n\t\t\treturn nil\n\t\t} else if IsDependencyViolation(err) {\n\t\t\treturn err\n\t\t}\n\t\treturn fmt.Errorf(\"error deleting Subnet %q: %v\", id, err)\n\t}\n\treturn nil\n}\n\nfunc ListSubnets(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {\n\tctx := context.TODO()\n\tc := cloud.(awsup.AWSCloud)\n\tsubnets, err := DescribeSubnets(cloud)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing subnets: %v\", err)\n\t}\n\n\tvar resourceTrackers []*resources.Resource\n\telasticIPs := sets.NewString()\n\townedElasticIPs := sets.NewString()\n\tnatGatewayIds := sets.NewString()\n\townedNatGatewayIds := sets.NewString()\n\tfor _, subnet := range subnets {\n\t\tsubnetID := aws.ToString(subnet.SubnetId)\n\n\t\tshared := HasSharedTag(\"subnet:\"+subnetID, subnet.Tags, clusterName)\n\t\tresourceTracker := &resources.Resource{\n\t\t\tName:    FindName(subnet.Tags),\n\t\t\tID:      subnetID,\n\t\t\tType:    string(ec2types.ResourceTypeSubnet),\n\t\t\tDeleter: DeleteSubnet,\n\t\t\tDumper:  DumpSubnet,\n\t\t\tShared:  shared,","sourceCodeStart":742,"sourceCodeEnd":778,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L742-L778","documentation":"ListSubnets delegates enumeration to DescribeSubnets and wraps any failure in this error. It means the subnet listing pipeline failed before any subnet resources could be tracked. The inner error (from DescribeSubnets/DescribeSubnetsPaginator) is embedded via %v.","triggerScenarios":"The underlying ec2:DescribeSubnets call fails: UnauthorizedOperation/AuthFailure, RequestLimitExceeded throttling, invalid credentials, or network/endpoint failure.","commonSituations":"IAM policy missing ec2:DescribeSubnets; expired credentials on long-lived CI jobs; EC2 throttling in busy accounts; misconfigured region (empty/wrong default).","solutions":["Check the inner error; grant ec2:DescribeSubnets if it's an authorization failure.","Fix credentials/region configuration (aws sts get-caller-identity to validate).","Retry with exponential backoff on throttling errors.","Verify connectivity to the regional EC2 endpoint."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if _, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}); err != nil { return fmt.Errorf(\"invalid AWS session: %w\", err) }","typeGuard":"func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == \"UnauthorizedOperation\" || ae.ErrorCode() == \"AuthFailure\" || ae.ErrorCode() == \"AccessDenied\") }","tryCatchPattern":"if err != nil {\n  if isAuthError(err) { return fmt.Errorf(\"IAM missing ec2:DescribeSubnets: %w\", err) }\n  if isThrottling(err) { return backoffRetry() }\n  return err\n}","preventionTips":["Include ec2:DescribeSubnets (or ec2:Describe*) in the kops IAM policy.","Pin AWS_REGION explicitly in CI environments.","Pre-warm/validate the session before batch operations.","Monitor CloudTrail for AccessDenied to pinpoint missing permissions."],"tags":["aws","ec2","vpc","subnet","api-error"],"backgroundTag":"aws-credentials-or-iam-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}