kubernetes/kops · error

error listing images: %v

Error message

error listing images: %v

What it means

The paginated EC2 DescribeImages call failed while resolving an image name (e.g. owner/name) to a concrete AMI. Fires on API errors, throttling, or an invalid owner/image-name specification that the API rejects.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1749

			// self is a well-known value in the DescribeImages call
			request.Owners = []string{"self"}
			request.Filters = append(request.Filters, NewEC2Filter("name", name))
		} else if len(tokens) == 2 {
			owner := ResolveImageOwnerAlias(tokens[0])

			request.Owners = []string{owner}
			request.Filters = append(request.Filters, NewEC2Filter("name", tokens[1]))
		} else {
			return nil, fmt.Errorf("image name specification not recognized: %q", name)
		}
	}

	var image *ec2types.Image
	paginator := ec2.NewDescribeImagesPaginator(ec2Client, request)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, fmt.Errorf("error listing images: %v", err)
		}

		for _, v := range page.Images {
			if image == nil {
				image = &v
			} else {
				itime, _ := time.Parse(time.RFC3339, *image.CreationDate)
				vtime, _ := time.Parse(time.RFC3339, *v.CreationDate)
				if vtime.After(itime) {
					image = &v
				}
			}
		}
	}
	if image == nil {
		return nil, fmt.Errorf("could not find Image for %q", name)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS message: AccessDenied → add ec2:DescribeImages; Throttling → back off and retry
2. Validate the owner and name filter by running `aws ec2 describe-images --owners <owner> --filters Name=name,Values=<name>`
3. Fix credentials/region so the EC2 client targets the intended account and region
4. Retry later if it is a rate-limit error; batch kops operations to reduce call volume

Example fix

// before
# AccessDenied on describe-images
// after
# attach to the IAM policy:
{"Effect":"Allow","Action":["ec2:DescribeImages"],"Resource":"*"}

// Pre-check IAM: the caller must be able to describe images
_, err := ec2Client.DescribeImages(ctx, &ec2.DescribeImagesInput{
	Owners: []string{owner},
	Filters: []ec2types.Filter{ec2filter("name", imageName)},
	MaxResults: aws.Int32(5),
})
if err != nil { return fmt.Errorf("preflight describe-images failed: %w", err) }

img, err := resolveImage(ctx, ssmClient, ec2Client, name)
if err != nil {
	if strings.Contains(err.Error(), "Throttling") {
		time.Sleep(backoff); return resolveImage(ctx, ssmClient, ec2Client, name)
	}
	return err
}

When it happens

Trigger: paginator.NextPage(ctx) returns an error from DescribeImages: invalid filter values (bad owner ID or name pattern), expired/missing credentials, throttling (RequestLimitExceeded), or unauthorized DescribeImages.

Common situations: IAM role lacks ec2:DescribeImages; owner specified as a malformed account ID; API rate limits hit during large batch operations; VPC endpoint or proxy blocking EC2 API traffic.

Related errors

• error creating InternetGateway: %v
• error listing subnets in VPC %q: %v
• error checking if instance type %q is supported in region %q
• describing instance for arn %q
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/75d30c92eb433136. Report an issue: GitHub.