kubernetes/kops · error

error describing SecurityGroup %q: %v

Error message

error describing SecurityGroup %q: %v

What it means

In DeleteSecurityGroup (pkg/resources/aws/securitygroup.go:50), before deleting a security group the code describes it by ID to enumerate its rules. This error is returned when DescribeSecurityGroups fails with anything other than InvalidGroup.NotFound (which is treated as already-deleted). It means the pre-delete inspection of the SG failed.

Source

Thrown at pkg/resources/aws/securitygroup.go:50

func DeleteSecurityGroup(cloud fi.Cloud, t *resources.Resource) error {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	id := t.ID
	// First clear all inter-dependent rules
	// TODO: Move to a "pre-execute" phase?
	{
		request := &ec2.DescribeSecurityGroupsInput{
			GroupIds: []string{id},
		}
		response, err := c.EC2().DescribeSecurityGroups(ctx, request)
		if err != nil {
			if awsup.AWSErrorCode(err) == "InvalidGroup.NotFound" {
				klog.V(2).Infof("Got InvalidGroup.NotFound error describing SecurityGroup %q; will treat as already-deleted", id)
				return nil
			}
			return fmt.Errorf("error describing SecurityGroup %q: %v", id, err)
		}

		if len(response.SecurityGroups) == 0 {
			return nil
		}
		if len(response.SecurityGroups) != 1 {
			return fmt.Errorf("found multiple SecurityGroups with ID %q", id)
		}

		ruleReqest := &ec2.DescribeSecurityGroupRulesInput{
			Filters: []ec2types.Filter{
				{Name: aws.String("group-id"), Values: []string{id}},
			},
		}
		ruleResp, err := c.EC2().DescribeSecurityGroupRules(ctx, ruleReqest)
		if err != nil {
			if awsup.AWSErrorCode(err) == "InvalidGroup.NotFound" {
				klog.V(2).Infof("Got InvalidGroup.NotFound error describing rules for SecurityGroup %q; will treat as already-deleted", id)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant ec2:DescribeSecurityGroups in the deleting principal's IAM policy.
2. Verify the SG ID and that the client targets the same region/account as the SG.
3. If the group was already deleted, retry — InvalidGroup.NotFound is intentionally tolerated; other NotFound-shaped errors indicate SDK/error-code parsing issues.
4. Retry on transient throttling/network errors.

Example fix

null

null

func isAlreadyDeleted(err error) bool {
    return awsup.AWSErrorCode(err) == "InvalidGroup.NotFound"
}

err := DeleteSecurityGroup(cloud, resource)
var apiErr smithy.APIError
if errors.As(err, &apiErr) {
    switch apiErr.ErrorCode() {
    case "InvalidGroup.NotFound":
        return nil // treat as deleted
    case "UnauthorizedOperation":
        return fmt.Errorf("check IAM ec2:DescribeSecurityGroups: %w", err)
    }
}

When it happens

Trigger: EC2 DescribeSecurityGroups with GroupIds=[id] returning errors other than InvalidGroup.NotFound: UnauthorizedOperation (missing ec2:DescribeSecurityGroups), InvalidGroup.NotFound variants not matched by AWSErrorCode, throttling, malformed group ID (ValidationException), or network errors.

Common situations: IAM role restricted to DescribeSecurityGroups on tags only, blocking ID-based lookup; stale resource tracker referencing an SG in another region/account; network outage mid-deletion; SG ID typo when manually invoking deletion tooling.

Related errors

• error describing InternetGateway %q: %v
• found multiple SecurityGroups with ID %q
• error describing SecurityGroup rules %q: %v
• cannot revoke ingress for ID %q with rule IDs %v: %v
• error deleting SecurityGroup %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2fd126b5cc9fd5f7. Report an issue: GitHub.