kubernetes/kops · error

error listing SecurityGroup: %v

Error message

error listing SecurityGroup: %v

What it means

SecurityGroupRule.Find calls EC2 DescribeSecurityGroupRules (filtered by group-id) to locate the existing rule for delta computation, and wraps any API failure here. Note the message says 'listing SecurityGroup' but it is the rule-describe call that failed. This aborts the Find phase for the rule task.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygrouprule.go:80

	if e.SecurityGroup == nil || e.SecurityGroup.ID == nil {
		return nil, nil
	}

	if e.SourceGroup != nil && e.SourceGroup.ID == nil {
		klog.V(4).Infof("Skipping find of SecurityGroupRule %s, because SourceGroup was not found", fi.ValueOf(e.Name))
		return nil, nil
	}

	request := &ec2.DescribeSecurityGroupRulesInput{
		Filters: []ec2types.Filter{
			awsup.NewEC2Filter("group-id", *e.SecurityGroup.ID),
		},
	}

	response, err := cloud.EC2().DescribeSecurityGroupRules(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing SecurityGroup: %v", err)
	}

	if response == nil || len(response.SecurityGroupRules) == 0 {
		return nil, nil
	}

	var foundRule *ec2types.SecurityGroupRule

	for _, rule := range response.SecurityGroupRules {
		if e.matches(&rule) {
			foundRule = &rule
			break
		}
	}

	if foundRule != nil {
		actual := &SecurityGroupRule{
			ID:            foundRule.SecurityGroupRuleId,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify credentials/region (`aws sts get-caller-identity` in the same profile) and re-run kops
2. Add ec2:DescribeSecurityGroupRules to the IAM policy — older minimal EC2 policies lack it
3. Read the wrapped AWS error: AccessDenied → IAM fix; RequestLimitExceeded → retry / reduce parallelism; InvalidGroup.NotFound → reconcile the security group first
4. Retry `kops update cluster` after the transient condition clears

Example fix

// before (IAM policy)
{"Effect":"Allow","Action":["ec2:DescribeSecurityGroups"],"Resource":"*"}
// after
{"Effect":"Allow","Action":["ec2:DescribeSecurityGroups","ec2:DescribeSecurityGroupRules"],"Resource":"*"}

// Pre-flight the AWS identity and permission:
aws sts get-caller-identity
aws ec2 describe-security-group-rules --max-items 1  # fails fast if ec2:DescribeSecurityGroupRules is missing

if err := kopsUpdate(); err != nil {
  if strings.Contains(err.Error(), "error listing SecurityGroup") {
    // inspect wrapped cause: AccessDenied→IAM, RequestLimitExceeded→backoff+retry,
    // InvalidClientTokenId→refresh credentials
    log.Println(err)
  }
}

When it happens

Trigger: DescribeSecurityGroupRules fails during `kops update/replace`: auth failure (InvalidClientTokenId, expired credentials), AccessDenied on ec2:DescribeSecurityGroupRules, throttling (RequestLimitExceeded on large clusters with many rules), or InvalidGroup.NotFound if the referenced SG was deleted out-of-band.

Common situations: Old/rotated AWS credentials in env or state-store config; IAM policy missing the newer DescribeSecurityGroupRules action (introduced with SG rule IDs, 2021); region misconfiguration; applying huge clusters hitting EC2 rate limits.

Related errors

• error describing SecurityGroup rules %q: %v
• error listing SecurityGroups: %v
• error listing RouteTables: %v
• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c132a2ed644f7e07. Report an issue: GitHub.