kubernetes/kops · error

error adding AWS Tags to EBS Volume: %v

Error message

error adding AWS Tags to EBS Volume: %v

What it means

After creating or finding the EBS volume, RenderAWS applies the required tags via AddAWSTags (CreateTags API); a failure here aborts the task. Untagged volumes break kOps' tag-based discovery in Find(), so this is treated as fatal rather than a warning.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/ebsvolume.go:161

			AvailabilityZone:  e.AvailabilityZone,
			VolumeType:        e.VolumeType,
			KmsKeyId:          e.KmsKeyId,
			Encrypted:         e.Encrypted,
			Iops:              e.VolumeIops,
			Throughput:        e.VolumeThroughput,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVolume, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateVolume(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating PersistentVolume: %v", err)
		}

		e.ID = response.VolumeId
	}

	if err := t.AddAWSTags(*e.ID, e.Tags); err != nil {
		return fmt.Errorf("error adding AWS Tags to EBS Volume: %v", err)
	}

	if a != nil {
		if len(changes.Tags) > 0 {
			tagsToDelete := e.getEBSVolumeTagsToDelete(a.Tags)
			if len(tagsToDelete) > 0 {
				return t.DeleteTags(*e.ID, tagsToDelete)
			}
		}

		if len(changes.VolumeType) > 0 ||
			changes.VolumeIops != nil ||
			changes.VolumeThroughput != nil ||
			changes.SizeGB != nil {

			request := &ec2.ModifyVolumeInput{
				VolumeId:   a.ID,
				VolumeType: e.VolumeType,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant ec2:CreateTags in the IAM policy
2. Validate tag keys/values against AWS tag constraints (length, allowed characters)
3. Re-run `kops update cluster` to retry tagging
4. Check whether the volume ID still exists (concurrent deletion)

Example fix

// before (IAM)
{"Effect":"Allow","Action":["ec2:CreateVolume"],"Resource":"*"}
// after
{"Effect":"Allow","Action":["ec2:CreateVolume","ec2:CreateTags"],"Resource":"*"}

_, err := iamSimulate(iamClient, roleArn, "ec2:CreateTags")
if err != nil { return fmt.Errorf("IAM missing ec2:CreateTags: %w", err) }

if err := t.AddAWSTags(*e.ID, e.Tags); err != nil {
    var aerr smithy.APIError
    if errors.As(err, &aerr) && aerr.ErrorCode() == "InvalidParameterValue" {
        // validate tag chars/length before retry
    }
    return fmt.Errorf("error adding AWS Tags to EBS Volume: %w", err)
}

When it happens

Trigger: AddAWSTags fails during RenderAWS — typically missing ec2:CreateTags permission, invalid tag key/value characters, or the volume was deleted concurrently between creation and tagging.

Common situations: IAM policies lacking ec2:CreateTags; tag values containing characters AWS rejects; very large numbers of tags exceeding AWS limits.

Related errors

• found multiple Volumes with name: %s
• Unable to tag subnet %v
• provider ID cannot be empty
• error deleting Volume %q: %v
• error describing volumes: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ded0eb78260f5164. Report an issue: GitHub.