cilium/cilium · error

cannot parse aws managed prefix list entry: %w

Error message

cannot parse aws managed prefix list entry: %w

What it means

Each entry returned by GetManagedPrefixListEntries contains a Cidr string that is parsed with netip.ParsePrefix; if the string is not a valid CIDR prefix the error is wrapped as 'cannot parse aws managed prefix list entry'. This guards against malformed data coming back from the AWS API.

Source

Thrown at pkg/policy/groups/aws/aws.go:231

			return nil, fmt.Errorf("cannot retrieve aws managed prefix list information: %w", err)
		}

		for _, plist := range output.PrefixLists {
			input := &ec2.GetManagedPrefixListEntriesInput{
				PrefixListId: plist.PrefixListId,
			}

			paginator := ec2.NewGetManagedPrefixListEntriesPaginator(ec2Client, input)
			for paginator.HasMorePages() {
				output, err := paginator.NextPage(ctx)
				if err != nil {
					return nil, fmt.Errorf("cannot retrieve aws managed prefix list entries: %w", err)
				}

				for _, entry := range output.Entries {
					addr, err := netip.ParsePrefix(aws.ToString(entry.Cidr))
					if err != nil {
						return nil, fmt.Errorf("cannot parse aws managed prefix list entry: %w", err)
					}

					result = append(result, addr)
				}
			}
		}
	}

	return result, nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Log the raw entry.Cidr value to see what AWS returned
2. Skip/ignore non-CIDR entries instead of failing the whole resolution, if appropriate for your policy
3. Update the AWS SDK / Cilium to a version handling these entry types
4. If Cidr is empty, verify the prefix list contents in the AWS console

Example fix

// before
addr, err := netip.ParsePrefix(aws.ToString(entry.Cidr))
if err != nil {
    return nil, fmt.Errorf("cannot parse aws managed prefix list entry: %w", err)
}
// after
cidr := aws.ToString(entry.Cidr)
addr, err := netip.ParsePrefix(cidr)
if err != nil {
    p.log.Warn("skipping malformed prefix list entry", "cidr", cidr, "err", err)
    continue
}

// sanity-check CIDR strings you expect back from AWS
for _, e := range entries {
    cidr := aws.ToString(e.Cidr)
    if cidr == "" || !strings.Contains(cidr, "/") {
        log.Printf("skipping non-CIDR prefix list entry: %q", cidr)
    }
}

func isCIDR(s string) bool {
    _, err := netip.ParsePrefix(s)
    return err == nil
}

// usage: if !isCIDR(aws.ToString(entry.Cidr)) { skip }

_, err := netip.ParsePrefix(cidr)
if err != nil {
    log.Printf("malformed prefix list entry %q: %v — skipping", cidr, err)
    return nil // continue instead of failing group resolution
}

When it happens

Trigger: An entry's Cidr field is empty (aws.ToString on a nil value) or not in CIDR notation (e.g. missing prefix length), typically due to an unexpected API response or an entry type that is not a CIDR.

Common situations: AWS API behavior changes or SDK version mismatches producing nil Cidr, corrupted local prefix lists, or code paths assuming all entries are CIDRs when some are resources.

Related errors

• failed to parse label prefix %s: %w
• cannot retrieve aws managed prefix list information: %w
• cannot retrieve aws managed prefix list entries: %w
• not ready
• no cilium agent pods found

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/2e4b36f3de5e68b8. Report an issue: GitHub.