kubernetes/kops · error

error creating SQS queue: %v

Error message

error creating SQS queue: %v

What it means

After rendering the policy, RenderAWS creates the SQS queue via sqs.CreateQueue when the task does not yet exist (a == nil). Any AWS API rejection is wrapped as "error creating SQS queue". This is a hard failure: the queue task cannot be reconciled without the queue existing.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/sqs.go:227

func (q *SQS) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *SQS) error {
	ctx := context.TODO()
	policy, err := fi.ResourceAsString(e.Policy)
	if err != nil {
		return fmt.Errorf("error rendering RolePolicyDocument: %v", err)
	}

	if a == nil {
		request := &sqs.CreateQueueInput{
			Attributes: map[string]string{
				"MessageRetentionPeriod": strconv.Itoa(q.MessageRetentionPeriod),
				"Policy":                 policy,
			},
			QueueName: q.Name,
			Tags:      q.Tags,
		}
		response, err := t.Cloud.SQS().CreateQueue(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating SQS queue: %v", err)
		}

		attributes, err := t.Cloud.SQS().GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
			AttributeNames: []sqstypes.QueueAttributeName{sqstypes.QueueAttributeNameQueueArn},
			QueueUrl:       response.QueueUrl,
		})
		if err != nil {
			return fmt.Errorf("error getting SQS queue attributes: %v", err)
		}

		e.ARN = aws.String(attributes.Attributes["QueueArn"])
	}

	return nil
}

type terraformSQSQueue struct {
	Name                    *string                  `cty:"name"`

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error code; fix the specific issue (permissions, name, quota).
2. Verify the kOps IAM policy grants sqs:CreateQueue and sqs:SetQueueAttributes.
3. Check queue name derived from cluster/instance-group names for invalid characters or length.
4. Retry on throttling (AWS request rate exceeded); kOps reruns will converge.
5. Check service quotas for queues per region if 'Maximum number of queues' errors appear.

Example fix

// before (IAM policy)
// no sqs permissions
// after
{"Effect":"Allow","Action":["sqs:CreateQueue","sqs:SetQueueAttributes","sqs:GetQueueAttributes","sqs:DeleteQueue"],"Resource":"*"}

// pre-checks before apply
aws sqs list-queues --queue-name-prefix <name> # confirm name/quota situation
aws iam simulate-principal-policy --policy-source-arn <kopsRoleArn> --action-names sqs:CreateQueue

if err := kopsApply(ctx); err != nil {
    if strings.Contains(err.Error(), "error creating SQS queue") && strings.Contains(err.Error(), "Throttling") {
        time.Sleep(backoff); return kopsApply(ctx) // bounded retries
    }
    return err
}

When it happens

Trigger: t.Cloud.SQS().CreateQueue returns an error: invalid queue name (bad characters, >80 chars), tag limits/throttling, UnauthorizedOperation, or queue already exists with different attributes when a==nil is mis-detected.

Common situations: Queue name containing invalid characters from cluster name; AWS API throttling during large cluster creation; IAM role for kOps missing sqs:CreateQueue permission; account-level queue quota exceeded.

Related errors

• error creating EventBridge target: %v
• error listing resource record sets: %w
• describing instance for arn %q
• rendering policy as json: %w
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8ea766dfbb9fda1c. Report an issue: GitHub.