kubernetes/kops · error

error creating SecurityGroup: %v

Error message

error creating SecurityGroup: %v

What it means

CreateSecurityGroup failed during RenderAWS — usually a same-name group already exists in the VPC, a VPC misconfiguration, or missing ec2:CreateSecurityGroup permission; the wrapped error is the AWS API response.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygroup.go:182

	shared := fi.ValueOf(e.Shared)
	if shared {
		// Do we want to do any verification of the security group?
		return nil
	}

	if a == nil {
		klog.V(2).Infof("Creating SecurityGroup with Name:%q VPC:%q", *e.Name, *e.VPC.ID)

		request := &ec2.CreateSecurityGroupInput{
			VpcId:             e.VPC.ID,
			GroupName:         e.Name,
			Description:       e.Description,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroup, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateSecurityGroup(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating SecurityGroup: %v", err)
		}

		e.ID = response.GroupId
	}

	return t.AddAWSTags(*e.ID, e.Tags)
}

type terraformSecurityGroup struct {
	Name        *string                  `cty:"name"`
	VPCID       *terraformWriter.Literal `cty:"vpc_id"`
	Description *string                  `cty:"description"`
	Tags        map[string]string        `cty:"tags"`
}

func (_ *SecurityGroup) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *SecurityGroup) error {
	shared := fi.ValueOf(e.Shared)
	if shared {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause: InvalidGroup.Duplicate — delete or import the existing SG with matching tags
2. InvalidVpcID.NotFound — verify the VPC exists in the configured region or fix spec network config
3. LimitExceeded — request a quota increase or delete unused SGs
4. UnauthorizedOperation — add ec2:CreateSecurityGroup to the IAM policy

Example fix

// remove leftover duplicate before re-running kops update
aws ec2 delete-security-group --group-id <leftover-sg-id>

aws ec2 describe-security-groups --filters Name=group-name,<sg-name> Name=vpc-id,<vpc-id> # detect pre-existing duplicate name
aws servicequotas get-service-quota --service-code ec2 --quota-code L-2D98A712 # SG quota

if err != nil {
  switch {
  case strings.Contains(err.Error(), "InvalidGroup.Duplicate"):
    // adopt or delete the existing SG, then re-run
  case strings.Contains(err.Error(), "InvalidVpcID.NotFound"):
    // fix VPC/region config
  case strings.Contains(err.Error(), "LimitExceeded"):
    // raise quota
  }
}

When it happens

Trigger: CreateSecurityGroup fails: InvalidGroup.Duplicate (a SG with that name already exists in the VPC), UnauthorizedOperation, InvalidVpcID.NotFound (VPC deleted or wrong region), or LimitExceeded (SG quota).

Common situations: Leftover security group from a prior failed cluster create with the same name; VPC deleted out-of-band while kOps state persists; AWS security group per-VPC quota exhausted; IAM missing ec2:CreateSecurityGroup.

Related errors

• error listing SecurityGroups: %v
• error listing resource record sets: %w
• describing instance for arn %q
• error terminating instances: %v
• error describing instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/07146a498c89cfe7. Report an issue: GitHub.