{"record":{"id":"ee017a735758ef5d","repo":"kubernetes/kops","slug":"error-detaching-internetgateway-q-v","errorCode":null,"errorMessage":"error detaching InternetGateway %q: %v","messagePattern":"error detaching InternetGateway %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/aws/aws.go","lineNumber":1037,"sourceCode":"\t\t}\n\t\tif len(response.InternetGateways) != 1 {\n\t\t\treturn fmt.Errorf(\"found multiple InternetGateways with id %q\", id)\n\t\t}\n\t\tigw = &response.InternetGateways[0]\n\t}\n\n\tfor _, a := range igw.Attachments {\n\t\tklog.V(2).Infof(\"Detaching EC2 InternetGateway %q\", id)\n\t\trequest := &ec2.DetachInternetGatewayInput{\n\t\t\tInternetGatewayId: &id,\n\t\t\tVpcId:             a.VpcId,\n\t\t}\n\t\t_, err := c.EC2().DetachInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\tif IsDependencyViolation(err) {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error detaching InternetGateway %q: %v\", id, err)\n\t\t}\n\t}\n\n\t{\n\t\tklog.V(2).Infof(\"Deleting EC2 InternetGateway %q\", id)\n\t\trequest := &ec2.DeleteInternetGatewayInput{\n\t\t\tInternetGatewayId: &id,\n\t\t}\n\t\t_, err := c.EC2().DeleteInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\tif IsDependencyViolation(err) {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif awsup.AWSErrorCode(err) == \"InvalidInternetGatewayID.NotFound\" {\n\t\t\t\tklog.Infof(\"Internet gateway %q not found; assuming already deleted\", id)\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error deleting InternetGateway %q: %v\", id, err)","sourceCodeStart":1019,"sourceCodeEnd":1055,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/aws/aws.go#L1019-L1055","documentation":"kOps wraps failures from the EC2 DetachInternetGateway call while disassociating the IGW from its VPC before deletion. Dependency violations are returned bare so the caller retries with backoff (the VPC still references the gateway); all other errors are wrapped with the IGW ID.","triggerScenarios":"EC2 DetachInternetGateway fails with something other than a dependency violation: the attachment ID no longer exists (already detached), wrong region, throttling, or auth failure.","commonSituations":"The IGW was detached concurrently by another cleanup process or operator; stale kOps resource tracker holding an old attachment; throttling during parallel teardown of many clusters.","solutions":["Check current state: `aws ec2 describe-internet-gateways --internet-gateway-ids <id>` — if Attachment is empty it is already detached; re-run kOps delete and it will proceed to deletion","Retry with backoff; kOps automatically retries dependency violations until the VPC detaches","Confirm region correctness — the IGW must be in the region kOps is operating on","Verify IAM permissions for ec2:DetachInternetGateway"],"exampleFix":"// before: one-shot detach\n_, err := c.EC2().DetachInternetGateway(ctx, request)\n// after: tolerate already-detached\nif awsup.AWSErrorCode(err) == \"InvalidAttachmentID.NotFound\" {\n\treturn nil\n}","handlingStrategy":"retry","validationCode":"// only detach if still attached\nout, err := c.EC2().DescribeInternetGateways(ctx, &ec2.DescribeInternetGatewaysInput{\n\tInternetGatewayIds: []string{id},\n})\nif err != nil { return err }\nif len(out.InternetGateways) == 0 || len(out.InternetGateways[0].Attachments) == 0 {\n\treturn nil // nothing to detach\n}","typeGuard":"func igwAttached(igw *ec2types.InternetGateway) bool {\n\treturn igw != nil && len(igw.Attachments) > 0\n}","tryCatchPattern":"_, err := c.EC2().DetachInternetGateway(ctx, request)\nif err != nil {\n\tif awserrors.IsDependencyViolation(err) {\n\t\treturn backoff.Retry(func() error { return detachAgain() }, expBackoff)\n\t}\n\tif awsup.AWSErrorCode(err) == \"InvalidAttachmentID.NotFound\" {\n\t\treturn nil // already detached\n\t}\n\treturn fmt.Errorf(\"error detaching InternetGateway %q: %v\", id, err)\n}","preventionTips":["Do not run manual IGW detaches concurrently with kops delete","Retry with exponential backoff — VPC/VPN teardown can hold attachments briefly","Ensure operations target the correct region for the cluster","Confirm IAM allows ec2:DetachInternetGateway"],"tags":["aws","ec2","internet-gateway","detach","vpc"],"backgroundTag":"aws-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}