{"record":{"id":"f89813c142846f6b","repo":"kubernetes/kops","slug":"error-creating-instance-v","errorCode":null,"errorMessage":"error creating Instance: %v","messagePattern":"error creating Instance: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/instance.go","lineNumber":294,"sourceCode":"\t\t\t\t// But it exposes some bugs in the AWS console, so if we can avoid it, we should\n\t\t\t\t//d, err = fi.GzipBytes(d)\n\t\t\t\t//if err != nil {\n\t\t\t\t//\treturn fmt.Errorf(\"error while gzipping UserData: %v\", err)\n\t\t\t\t//}\n\t\t\t\treturn fmt.Errorf(\"Instance UserData was too large (%d bytes)\", len(d))\n\t\t\t}\n\t\t\trequest.UserData = aws.String(base64.StdEncoding.EncodeToString(d))\n\t\t}\n\n\t\tif e.IAMInstanceProfile != nil {\n\t\t\trequest.IamInstanceProfile = &ec2types.IamInstanceProfileSpecification{\n\t\t\t\tName: e.IAMInstanceProfile.Name,\n\t\t\t}\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().RunInstances(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating Instance: %v\", err)\n\t\t}\n\n\t\te.ID = response.Instances[0].InstanceId\n\t}\n\n\treturn t.AddAWSTags(*e.ID, e.Tags)\n}\n\nfunc (e *Instance) TerraformLink() *terraformWriter.Literal {\n\tif fi.ValueOf(e.Shared) {\n\t\tif e.ID == nil {\n\t\t\tklog.Fatalf(\"ID must be set, if NAT Instance is shared: %s\", e)\n\t\t}\n\n\t\treturn terraformWriter.LiteralFromStringValue(*e.ID)\n\t}\n\n\treturn terraformWriter.LiteralSelfLink(\"aws_instance\", *e.Name)","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/instance.go#L276-L312","documentation":"Instance.RenderAWS calls EC2 RunInstances to create the instance; any API error from AWS is wrapped as 'error creating Instance: %v'. This is the generic failure point for instance creation: invalid parameters (AMI, subnet, SG, key, IAM profile), quota/capacity limits, or authorization problems. No instance ID is assigned, so the task fails.","triggerScenarios":"RunInstances returns an AWS error: InvalidAMIID.NotFound, InvalidSubnetID.NotFound, InvalidKeyPair.NotFound, InsufficientInstanceCapacity, VcpuLimitExceeded, UnauthorizedOperation, or invalid network-interface parameters (e.g. bad PrivateIpAddress in subnet).","commonSituations":"AMI not available in the target region; subnet or security group IDs deleted or from another VPC; EC2 vCPU service quota exhausted; spot/capacity constraints; IAM credentials lacking ec2:RunInstances; specifying a private IP already in use; SSH key name that does not exist in the region.","solutions":["Read the wrapped AWS error after the colon (e.g. InvalidAMIID.NotFound) and fix the referenced resource ID.","Verify AMI, subnet, SGs, and keypair exist in the target region: `aws ec2 describe-images|describe-subnets|describe-security-groups|describe-key-pairs`.","Check EC2 service quotas (vCPU limit) in the region and request an increase if needed.","Confirm AWS credentials/IAM policy allow ec2:RunInstances for the task's role.","Retry if the error is InsufficientInstanceCapacity, possibly with a different instance type or AZ."],"exampleFix":"# before\nkops set cluster spec image: ami-0123456789abcdef0   # not present in eu-west-1\n# after\naws ec2 describe-images --region eu-west-1 --owners amazon --filters Name=name,Values=amzn2-ami-hvm-*\nkops edit cluster  # image: ami-<valid-in-region>\nkops update cluster","handlingStrategy":"retry","validationCode":"// Pre-flight: validate referenced resources exist before RunInstances\nfunc preflight(client *ec2.Client, imageID, subnetID, keyName string, sgIDs []string) error {\n\tif _, err := client.DescribeImages(ctx, &ec2.DescribeImagesInput{ImageIds: []string{imageID}}); err != nil {\n\t\treturn fmt.Errorf(\"AMI %s invalid: %w\", imageID, err)\n\t}\n\tif _, err := client.DescribeSubnets(ctx, &ec2.DescribeSubnetsInput{SubnetIds: []string{subnetID}}); err != nil {\n\t\treturn fmt.Errorf(\"subnet %s invalid: %w\", subnetID, err)\n\t}\n\tif _, err := client.DescribeSecurityGroups(ctx, &ec2.DescribeSecurityGroupsInput{GroupIds: sgIDs}); err != nil {\n\t\treturn fmt.Errorf(\"security groups invalid: %w\", err)\n\t}\n\tif keyName != \"\" {\n\t\tif _, err := client.DescribeKeyPairs(ctx, &ec2.DescribeKeyPairsInput{KeyNames: []string{keyName}}); err != nil {\n\t\t\treturn fmt.Errorf(\"keypair %s missing: %w\", keyName, err)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"err := applyCluster(ctx)\nvar retryable = []string{\"InsufficientInstanceCapacity\", \"RequestLimitExceeded\", \"InternalError\", \"Throttling\"}\nif err != nil {\n\tfor _, s := range retryable {\n\t\tif strings.Contains(err.Error(), \"error creating Instance\") && strings.Contains(err.Error(), s) {\n\t\t\ttime.Sleep(30 * time.Second) // backoff, then retry kops update\n\t\t\treturn applyCluster(ctx)\n\t\t}\n\t}\n\treturn err\n}\nreturn nil","preventionTips":["Pin AMIs that are replicated in every target region kOps runs in.","Check EC2 vCPU quotas per region before large cluster builds.","Ensure the kOps IAM policy covers ec2:RunInstances and related Describe* calls.","Keep subnet/SG/keypair IDs generated from the same cluster spec to avoid cross-VPC mismatches.","Retry with backoff on capacity/throttling errors; fail fast on Invalid*NotFound errors."],"tags":["aws","ec2","runinstances","api-error","instance-creation"],"backgroundTag":"aws-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}