{"record":{"id":"f2937480afcd442e","repo":"kubernetes/kops","slug":"error-listing-eventbridge-rules-v-f29374","errorCode":null,"errorMessage":"error listing EventBridge rules: %v","messagePattern":"error listing EventBridge rules: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/eventbridgerule.go","lineNumber":64,"sourceCode":"var _ fi.CompareWithID = (*EventBridgeRule)(nil)\n\nfunc (eb *EventBridgeRule) CompareWithID() *string {\n\treturn eb.Name\n}\n\nfunc (eb *EventBridgeRule) Find(c *fi.CloudupContext) (*EventBridgeRule, error) {\n\tcloud := awsup.GetCloud(c)\n\n\tif eb.Name == nil {\n\t\treturn nil, nil\n\t}\n\n\trequest := &eventbridge.ListRulesInput{\n\t\tNamePrefix: eb.Name,\n\t}\n\tresponse, err := cloud.EventBridge().ListRules(c.Context(), request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing EventBridge rules: %v\", err)\n\t}\n\tif response == nil || len(response.Rules) == 0 {\n\t\treturn nil, nil\n\t}\n\tif len(response.Rules) > 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple EventBridge rules with the same name\")\n\t}\n\n\trule := response.Rules[0]\n\n\ttagResponse, err := cloud.EventBridge().ListTagsForResource(c.Context(), &eventbridge.ListTagsForResourceInput{ResourceARN: rule.Arn})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing tags for EventBridge rule: %v\", err)\n\t}\n\n\tactual := &EventBridgeRule{\n\t\tID:           eb.ID,\n\t\tName:         eb.Name,","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/eventbridgerule.go#L46-L82","documentation":"EventBridgeRule.Find lists rules with ListRules(NamePrefix=ruleName) to reconcile declared EventBridge rules. Any AWS error from ListRules is wrapped as 'error listing EventBridge rules: %v'. This is an API-level failure during lookup, not an indication about rule presence.","triggerScenarios":"cloud.EventBridge().ListRules fails: IAM denial of events:ListRules, invalid/missing region endpoint, throttling, or network errors during kops reconciliation of a cluster with EventBridge rules (e.g. trust to sqs for EventBridge notifications).","commonSituations":"Least-privilege IAM lacking events:ListRules; wrong region configuration (rules are regional); transient AWS events endpoint failures.","solutions":["Grant events:ListRules (and events:ListTagsForResource) in the kops IAM policy","Confirm the cluster's region is correct — EventBridge rules are regional","Retry after throttling/transient errors","Check the underlying error text in the message for the exact AWS SDK failure"],"exampleFix":"// before\n// policy missing events actions\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"events:ListRules\",\"events:ListTagsForResource\",\"events:PutRule\"],\"Resource\":\"*\"}","handlingStrategy":"retry","validationCode":"// pre-check permissions\n// aws iam simulate-principal-policy --action-names events:ListRules\nif region == \"\" { return errors.New(\"region required for EventBridge (rules are regional)\") }","typeGuard":null,"tryCatchPattern":"var ae smithy.APIError\nif errors.As(err, &ae) {\n    if ae.ErrorCode() == \"ThrottlingException\" { /* backoff & retry */ }\n    if ae.ErrorCode() == \"AccessDeniedException\" { /* fix IAM: events:ListRules */ }\n}","preventionTips":["Include events:ListRules in kops IAM policies","Remember EventBridge is regional — align cluster region config","Add SDK retries/backoff for throttling","Verify endpoint reachability (VPC endpoints / proxies)"],"tags":["aws","eventbridge","api-error","iam"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}