kubernetes/kops · error

error deleting SecurityGroup %q: %v

Error message

error deleting SecurityGroup %q: %v

What it means

In DeleteSecurityGroup (pkg/resources/aws/securitygroup.go:103), after clearing rules the SG is deleted via DeleteSecurityGroup. Dependency violations (IsDependencyViolation, e.g. DependencyViolation / another resource in use) are returned raw so the deletion loop can retry; any other error is wrapped with this message. It means the final DeleteSecurityGroup call failed for a non-dependency reason.

Source

Thrown at pkg/resources/aws/securitygroup.go:103

			}
			_, err = c.EC2().RevokeSecurityGroupIngress(ctx, revoke)
			if err != nil {
				return fmt.Errorf("cannot revoke ingress for ID %q with rule IDs %v: %v", id, ingressRuleIDs, err)
			}
		}
	}

	{
		klog.V(2).Infof("Deleting EC2 SecurityGroup %q", id)
		request := &ec2.DeleteSecurityGroupInput{
			GroupId: &id,
		}
		_, err := c.EC2().DeleteSecurityGroup(ctx, request)
		if err != nil {
			if IsDependencyViolation(err) {
				return err
			}
			return fmt.Errorf("error deleting SecurityGroup %q: %v", id, err)
		}
	}
	return nil
}

func DumpSecurityGroup(op *resources.DumpOperation, r *resources.Resource) error {
	data := make(map[string]interface{})
	data["id"] = r.ID
	data["type"] = ec2types.ResourceTypeSecurityGroup
	data["raw"] = r.Obj
	op.Dump.Resources = append(op.Dump.Resources, data)
	return nil
}

func ListSecurityGroups(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	groups, err := DescribeSecurityGroups(cloud, clusterName)
	if err != nil {
		return nil, err

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant ec2:DeleteSecurityGroup in the IAM policy.
2. If InvalidGroup.NotFound, treat as success and skip (group was concurrently removed).
3. Check the raw wrapped AWS error code; fix the specific cause (ENI attachments, region mismatch, credentials).
4. Retry later if throttled or if a dependency violation race occurred.

Example fix

// before
return fmt.Errorf("error deleting SecurityGroup %q: %v", id, err)
// after
if awsup.AWSErrorCode(err) == "InvalidGroup.NotFound" {
    klog.V(2).Infof("SecurityGroup %q already deleted", id)
    return nil
}
return fmt.Errorf("error deleting SecurityGroup %q: %w", id, err)

// ensure no ENIs still reference the SG before deleting
enis, _ := ec2Client.DescribeNetworkInterfaces(ctx, &ec2.DescribeNetworkInterfacesInput{
    Filters: []ec2types.Filter{{Name: aws.String("group-id"), Values: []string{id}}},
})
if len(enis.NetworkInterfaces) > 0 { return fmt.Errorf("SG %q still attached to %d ENIs", id, len(enis.NetworkInterfaces)) }

func isDependencyViolationErr(err error) bool { return IsDependencyViolation(err) }
func isNotFoundErr(err error) bool { return awsup.AWSErrorCode(err) == "InvalidGroup.NotFound" }

_, err := ec2Client.DeleteSecurityGroup(ctx, req)
if err != nil {
    if isNotFoundErr(err) { return nil }
    if isDependencyViolationErr(err) { return err } // retried by deletion loop
    return fmt.Errorf("error deleting SecurityGroup %q: %w", id, err)
}

When it happens

Trigger: EC2 DeleteSecurityGroup failing with errors other than dependency violations: UnauthorizedOperation (missing ec2:DeleteSecurityGroup), InvalidGroup.NotFound shapes not pre-filtered (race after describe), AuthFailure, throttling, or network errors.

Common situations: IAM policy lacking DeleteSecurityGroup; SG deleted concurrently by another process between describe and delete; SG still attached to an ENI with a differently-detected dependency error; deleting shared (non-owned) groups blocked by policy.

Related errors

• error deleting RouteTable %q: %v
• error deleting DhcpOptions %q: %v
• error deleting InternetGateway %q: %v
• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/60ecec6071953786. Report an issue: GitHub.