kubernetes/kops · error

error creating SecurityGroupIngress: %v

Error message

error creating SecurityGroupIngress: %v

What it means

RenderAWS (creation path, a==nil) calls AuthorizeSecurityGroupIngress to create a new ingress rule, and wraps any AWS failure here. Raised for new SecurityGroupRule tasks with Egress false/nil, including rules whose source is another security group (UserIdGroupPairs).

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygrouprule.go:332

			request.IpPermissions = []ec2types.IpPermission{ipPermission}
			request.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)

			klog.V(2).Infof("%s: Calling EC2 AuthorizeSecurityGroupEgress (%s)", name, description)
			_, err := t.Cloud.EC2().AuthorizeSecurityGroupEgress(ctx, request)
			if err != nil {
				return fmt.Errorf("error creating SecurityGroupEgress: %v", err)
			}
		} else {
			request := &ec2.AuthorizeSecurityGroupIngressInput{
				GroupId: e.SecurityGroup.ID,
			}
			request.IpPermissions = []ec2types.IpPermission{ipPermission}
			request.TagSpecifications = awsup.EC2TagSpecification(ec2types.ResourceTypeSecurityGroupRule, e.Tags)

			klog.V(2).Infof("%s: Calling EC2 AuthorizeSecurityGroupIngress (%s)", name, description)
			_, err := t.Cloud.EC2().AuthorizeSecurityGroupIngress(ctx, request)
			if err != nil {
				return fmt.Errorf("error creating SecurityGroupIngress: %v", err)
			}
		}

	} else if changes.Tags != nil {
		return t.AddAWSTags(*a.ID, e.Tags)
	}

	// No tags on security group rules (there are tags on the group though)

	return nil
}

type terraformSecurityGroupIngress struct {
	Type *string `cty:"type"`

	SecurityGroup *terraformWriter.Literal `cty:"security_group_id"`
	SourceGroup   *terraformWriter.Literal `cty:"source_security_group_id"`

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error to identify the exact AWS cause (bad parameter vs missing group vs auth)
2. Verify SourceGroup IDs exist in the same VPC/region; if cross-account, ensure the other account allows it
3. Validate CIDR/IPv6CIDR/PrefixList values in the spec (valid CIDR notation, pl- prefix)
4. Fix IAM permissions (ec2:AuthorizeSecurityGroupIngress) or credentials, then re-run `kops update cluster --yes`

Example fix

// before (IAM policy)
{"Effect":"Allow","Action":["ec2:AuthorizeSecurityGroupEgress"],"Resource":"*"}
// after
{"Effect":"Allow","Action":["ec2:AuthorizeSecurityGroupEgress","ec2:AuthorizeSecurityGroupIngress"],"Resource":"*"}

// Validate inputs before applying:
import "net"
func validCIDR(s string) bool { _, _, err := net.ParseCIDR(s); return err == nil }
// Ensure both target and source SGs exist in the same VPC:
aws ec2 describe-security-groups --group-ids $SG_ID,$SOURCE_SG_ID

if err := kopsUpdate(); err != nil {
  if strings.Contains(err.Error(), "error creating SecurityGroupIngress") {
    // InvalidGroup.NotFound → source/target SG missing; InvalidParameterValue → bad CIDR;
    // AccessDenied → IAM. Log and fix the wrapped AWS cause.
    log.Println(err)
  }
}

When it happens

Trigger: AuthorizeSecurityGroupIngress fails: InvalidGroup.NotFound (target or source SG gone mid-apply), InvalidParameterValue (malformed CIDR/prefix list), referenced SourceGroup in another account without allow-cross-account permissions, throttling, or AccessDenied on ec2:AuthorizeSecurityGroupIngress.

Common situations: Cluster spec references a SourceGroup that was deleted or not yet created in this apply run; typo'd CIDR; node→master SG reference invalid after cluster re-creation; IAM lacking the ingress authorize action.

Related errors

• cannot revoke ingress for ID %q with rule IDs %v: %v
• error creating SecurityGroupEgress: %v
• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q
• error describing SecurityGroup rules %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/67450dfd6cbeef28. Report an issue: GitHub.