kubernetes/kops · error

error creating EventBridge target: %v

Error message

error creating EventBridge target: %v

What it means

RenderAWS for EventBridgeTarget calls PutTargets to attach the SQS queue target to the rule and wraps any API error in this message. It fires only on the create/update branch of the target reconciliation.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/eventbridgetarget.go:124

	return nil
}

func (eb *EventBridgeTarget) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *EventBridgeTarget) error {
	if a == nil {
		target := eventbridgetypes.Target{
			Arn: eb.SQSQueue.ARN,
			Id:  aws.String("1"),
		}

		request := &eventbridge.PutTargetsInput{
			Rule:    eb.Rule.Name,
			Targets: []eventbridgetypes.Target{target},
		}

		_, err := t.Cloud.EventBridge().PutTargets(context.TODO(), request)
		if err != nil {
			return fmt.Errorf("error creating EventBridge target: %v", err)
		}
	}

	return nil
}

type terraformEventBridgeTarget struct {
	RuleName  *terraformWriter.Literal `cty:"rule"`
	TargetArn *terraformWriter.Literal `cty:"arn"`
}

func (_ *EventBridgeTarget) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *EventBridgeTarget) error {
	tf := &terraformEventBridgeTarget{
		RuleName:  e.Rule.TerraformLink(),
		TargetArn: e.SQSQueue.TerraformLink(),
	}

	return t.RenderResource("aws_cloudwatch_event_target", *e.Name, tf)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the SQS queue ARN exists in the same region/account as the rule.
2. Add a queue policy statement allowing events.amazonaws.com to sqs:SendMessage on the queue.
3. Ensure the EventBridgeRule exists before PutTargets; add eventbridge:PutTargets to IAM.

Example fix

// before: no queue policy
// after: allow EventBridge to send messages
{"Statement":[{"Effect":"Allow","Principal":{"Service":"events.amazonaws.com"},"Action":"sqs:SendMessage","Resource":"arn:aws:sqs:us-east-1:123456789012:kops-event-queue"}]}

// Verify queue ARN and region before PutTargets
queueArn := strings.TrimPrefix(fi.ValueOf(eb.SQSQueue.ARN), "arn:aws:sqs:")
region := strings.Split(queueArn, ":")[0]
if region != targetRegion { return fmt.Errorf("queue region %s != rule region %s", region, targetRegion) }

When it happens

Trigger: PutTargets fails: the rule does not exist, the target ARN (SQS queue) is invalid or in another region/account, sqs:SendMessage permission missing on the queue resource policy for events.amazonaws.com, or eventbridge:PutTargets denied.

Common situations: Queue created in a different region than the rule; SQS queue policy not granting events.amazonaws.com SendMessage; deleted/renamed rule referenced by a stale cluster spec.

Related errors

• error creating EventBridge rule: %v
• error creating SQS queue: %v
• rendering policy as json: %w
• listing targets for EventBridge rule %q: %w
• removing targets for EventBridge rule %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8abe50af4d868bfb. Report an issue: GitHub.