kubernetes/kops · error

error creating InternetGateway: %v

Error message

error creating InternetGateway: %v

What it means

This wraps the failure of the EC2 CreateInternetGateway call when kOps needs to create a new (non-shared) Internet Gateway. Any AWS-side rejection of the create call surfaces here with the underlying API error interpolated.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/internetgateway.go:162

	if shared {
		// Verify the InternetGateway was found and matches our required settings
		if a == nil {
			return fmt.Errorf("InternetGateway for shared VPC was not found")
		}

		return nil
	}

	if a == nil {
		klog.V(2).Infof("Creating InternetGateway")

		request := &ec2.CreateInternetGatewayInput{
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeInternetGateway, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateInternetGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating InternetGateway: %v", err)
		}

		e.ID = response.InternetGateway.InternetGatewayId
	}

	if a == nil || (changes != nil && changes.VPC != nil) {
		klog.V(2).Infof("Creating InternetGatewayAttachment")

		attachRequest := &ec2.AttachInternetGatewayInput{
			VpcId:             e.VPC.ID,
			InternetGatewayId: e.ID,
		}

		_, err := t.Cloud.EC2().AttachInternetGateway(ctx, attachRequest)
		if err != nil {
			return fmt.Errorf("error attaching InternetGateway to VPC: %v", err)
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant the kOps IAM role ec2:CreateInternetGateway (and ec2:CreateTags) permission.
2. Check the wrapped AWS error for tag validation problems and fix the cluster tags.
3. Retry if throttled; use backoff.
4. Check for organizational SCPs blocking EC2 creation.

Example fix

// before: IAM policy without create permission
// after: add statement
{"Effect":"Allow","Action":["ec2:CreateInternetGateway","ec2:CreateTags"],"Resource":"*"}

// Pre-flight IAM simulation
aws iam simulate-principal-policy \
  --policy-source-arn <kops-role-arn> \
  --action-names ec2:CreateInternetGateway ec2:CreateTags \
  --query 'EvaluationResults[].EvalDecision'   # expect ["allowed","allowed"]

func isAccessDenied(err error) bool {
    return strings.Contains(err.Error(), "UnauthorizedOperation") ||
           strings.Contains(err.Error(), "AccessDenied")
}

if strings.Contains(err.Error(), "error creating InternetGateway") {
    if isAccessDenied(err) {
        // fix IAM policy, then retry
    } else if strings.Contains(err.Error(), "Throttling") {
        time.Sleep(backoff)
        // retry
    }
}

When it happens

Trigger: t.Cloud.EC2().CreateInternetGateway returns an error during RenderAWS when a == nil and the task is not shared — typically AuthFailure/UnauthorizedOperation from missing ec2:CreateInternetGateway permission, throttling, or invalid TagSpecification (illegal tag keys/values).

Common situations: IAM policy missing ec2:CreateInternetGateway (common with least-privilege setups), tag keys containing forbidden characters (e.g. reserved aws: prefix), API rate limits, SCP denying EC2 resource creation.

Related errors

• error listing InternetGateway: %v
• error listing (all) InternetGateways: %v
• error listing InternetGateways: %v
• error listing images: %v
• error listing subnets in VPC %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8457c1b95ea1a6fd. Report an issue: GitHub.