kubernetes/kops · error

error creating SecurityGroupEgress: %v

Error message

error creating SecurityGroupEgress: %v

What it means

RenderAWS (creation path, a==nil) calls AuthorizeSecurityGroupEgress to create a new egress rule on the security group, including tag specifications, and wraps any AWS failure here. Raised when the SecurityGroupRule task is new and Egress is true.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygrouprule.go:320

		} else {
			ipPermission.IpRanges = []ec2types.IpRange{
				{CidrIp: aws.String("0.0.0.0/0")},
			}
		}

		description := e.Description()

		if fi.ValueOf(e.Egress) {
			request := &ec2.AuthorizeSecurityGroupEgressInput{
				GroupId: e.SecurityGroup.ID,
			}
			request.IpPermissions = []ec2types.IpPermission{ipPermission}
			request.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)

			klog.V(2).Infof("%s: Calling EC2 AuthorizeSecurityGroupEgress (%s)", name, description)
			_, err := t.Cloud.EC2().AuthorizeSecurityGroupEgress(ctx, request)
			if err != nil {
				return fmt.Errorf("error creating SecurityGroupEgress: %v", err)
			}
		} else {
			request := &ec2.AuthorizeSecurityGroupIngressInput{
				GroupId: e.SecurityGroup.ID,
			}
			request.IpPermissions = []ec2types.IpPermission{ipPermission}
			request.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)

			klog.V(2).Infof("%s: Calling EC2 AuthorizeSecurityGroupIngress (%s)", name, description)
			_, err := t.Cloud.EC2().AuthorizeSecurityGroupIngress(ctx, request)
			if err != nil {
				return fmt.Errorf("error creating SecurityGroupIngress: %v", err)
			}
		}

	} else if changes.Tags != nil {
		return t.AddAWSTags(*a.ID, e.Tags)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error: InvalidParameterValue → fix CIDR/IPv6CIDR/PrefixList in the cluster spec; InvalidGroup.NotFound → recreate the SG; AccessDenied → fix IAM
2. Validate the CIDR syntax (e.g. `10.0.0.0/8`, `::/0`) and that prefix lists start with `pl-` and exist in the region
3. Confirm ec2:AuthorizeSecurityGroupEgress permission and valid credentials
4. Re-run `kops update cluster --yes` if the failure was transient (throttling)

Example fix

// before (spec)
cidr: 10.0.0.0
// after
cidr: 10.0.0.0/8

// Validate CIDR/IPv6/prefix-list inputs before applying:
import "net"
func validCIDR(s string) bool { _, _, err := net.ParseCIDR(s); return err == nil }
func validPrefixList(s string) bool { return strings.HasPrefix(s, "pl-") }
// Ensure the SG exists: aws ec2 describe-security-groups --group-ids $SG_ID

if err := kopsUpdate(); err != nil {
  if strings.Contains(err.Error(), "error creating SecurityGroupEgress") {
    // InvalidParameterValue → fix CIDR; InvalidGroup.NotFound → recreate SG; AccessDenied → IAM
    log.Println(err)
  }
}

When it happens

Trigger: First-time creation or re-creation of an egress rule where AuthorizeSecurityGroupEgress fails: InvalidGroup.NotFound (SG deleted mid-apply), InvalidParameterValue (malformed CIDR/prefix-list/pl- id, bad IPv6 CIDR), missing source group, throttling, AccessDenied on ec2:AuthorizeSecurityGroupEgress.

Common situations: Typo'd CIDR in cluster spec (e.g. missing '/' in 10.0.0.0/8); prefix-list id deleted in AWS; SG removed by another tool while kops applies; IAM policy without the authorize action; rules referencing an out-of-region or cross-account group without permission.

Related errors

• error creating SecurityGroupIngress: %v
• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q
• error describing SecurityGroup rules %q: %v
• cannot revoke ingress for ID %q with rule IDs %v: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d36b4f5b8a87f979. Report an issue: GitHub.