kubernetes/kops · error

error attaching InternetGateway to VPC: %v

Error message

error attaching InternetGateway to VPC: %v

What it means

This error wraps a failure from the AWS EC2 AttachInternetGateway API call while applying an InternetGateway task against a VPC during kOps' AWS reconciliation (RenderAWS). It means AWS refused (or the call failed) to attach the internet gateway to the target VPC. kOps surfaces the underlying EC2 error message via %v so the real cause is in the wrapped error.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/internetgateway.go:178

		response, err := t.Cloud.EC2().CreateInternetGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating InternetGateway: %v", err)
		}

		e.ID = response.InternetGateway.InternetGatewayId
	}

	if a == nil || (changes != nil && changes.VPC != nil) {
		klog.V(2).Infof("Creating InternetGatewayAttachment")

		attachRequest := &ec2.AttachInternetGatewayInput{
			VpcId:             e.VPC.ID,
			InternetGatewayId: e.ID,
		}

		_, err := t.Cloud.EC2().AttachInternetGateway(ctx, attachRequest)
		if err != nil {
			return fmt.Errorf("error attaching InternetGateway to VPC: %v", err)
		}
	}

	return t.AddAWSTags(*e.ID, e.Tags)
}

type terraformInternetGateway struct {
	VPCID *terraformWriter.Literal `cty:"vpc_id"`
	Tags  map[string]string        `cty:"tags"`
}

func (_ *InternetGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *InternetGateway) error {
	ctx := context.TODO()
	shared := fi.ValueOf(e.Shared)
	if shared {
		// Not terraform owned / managed

		// But ... attempt to discover the ID so TerraformLink works

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error: if 'already attached', detach the IGW from the other VPC or create a new IGW for this VPC.
2. Verify the VPC ID referenced by the task (e.VPC.ID) exists and matches the intended cluster VPC.
3. Ensure the IAM role/policy used by kOps includes ec2:AttachInternetGateway.
4. Retry the apply if the error was transient (throttling: RequestLimitExceeded).

Example fix

// before: IGW shared/attached elsewhere
IGW already attached to vpc-old
// after
detach from vpc-old (or create a new InternetGateway task) and re-run kops update cluster

// before apply
aws ec2 describe-internet-gateways --filters Name=attachment.vpc-id,Values=$VPC_ID
// ensure the IGW is not already attached elsewhere and the VPC exists
aws ec2 describe-vpcs --vpc-ids $VPC_ID

err := runKopsUpdate(); if err != nil && strings.Contains(err.Error(), "error attaching InternetGateway") { detach IGW from other VPC or recreate IGW task, then retry once }

When it happens

Trigger: Calling RenderAWS on an internetgateway task whose e.ID is set and whose attachment state changed, where AttachInternetGateway returns an error - e.g. the IGW is already attached to a different VPC, the VPC ID is wrong/deleted, throttling, or invalid permission on the account.

Common situations: Reusing a shared internet gateway that is already attached to another VPC (an IGW can attach to only one VPC); a stale VPC reference after cluster recreation; AWS API throttling during large reconciliations; IAM policy denying ec2:AttachInternetGateway.

Related errors

• error detaching InternetGateway %q: %v
• cannot determine challenge endpoint for instance id: %s
• error deleting Subnet %q: %v
• error listing subnets: %v
• error describing InternetGateway %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b7af79df66a8595f. Report an issue: GitHub.