kubernetes/kops · error

error listing SQS queues: %v

Error message

error listing SQS queues: %v

What it means

ListSQSQueues in pkg/resources/aws/sqs.go calls SQS ListQueues with QueueNamePrefix = clusterName with dots replaced by dashes, wrapping any API failure with this message. It is the discovery step for cluster SQS queues during deletion, so failure prevents cleanup of those queues.

Source

Thrown at pkg/resources/aws/sqs.go:73

			return nil
		}
		return fmt.Errorf("error deleting SQS queue %q: %w", url, err)
	}
	return nil
}

func ListSQSQueues(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	c := cloud.(awsup.AWSCloud)

	klog.V(2).Infof("Listing SQS queues")
	queuePrefix := strings.ReplaceAll(clusterName, ".", "-")

	request := &sqs.ListQueuesInput{
		QueueNamePrefix: &queuePrefix,
	}
	response, err := c.SQS().ListQueues(context.TODO(), request)
	if err != nil {
		return nil, fmt.Errorf("error listing SQS queues: %v", err)
	}
	if response == nil || len(response.QueueUrls) == 0 {
		return nil, nil
	}

	var resourceTrackers []*resources.Resource

	for _, queueUrl := range response.QueueUrls {
		resourceTracker := &resources.Resource{
			Name:    queueUrl,
			ID:      queueUrl,
			Type:    "sqs",
			Deleter: DeleteSQSQueue,
			Dumper:  DumpSQSQueue,
			Obj:     queueUrl,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant sqs:ListQueues at the account/region level in the IAM policy.
2. Check credentials and region configuration of the AWSCloud client.
3. Retry with backoff on RequestThrottled.
4. Verify network reachability to the regional SQS endpoint.

// preflight: confirm SQS is reachable and credentials valid
ident, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
if err != nil { return fmt.Errorf("bad AWS credentials: %w", err) }
_ = ident

func isSQSAccessDenied(err error) bool {
    return err != nil && (awsup.AWSErrorCode(err) == "AccessDenied" || strings.Contains(err.Error(), "UnauthorizedOperation"))
}

queues, err := ListSQSQueues(cloud, vpcID, clusterName)
if err != nil {
    if isSQSAccessDenied(err) { klog.Warningf("skip SQS cleanup (no sqs:ListQueues): %v", err); queues = nil }
    else { return nil, err }
}

When it happens

Trigger: SQS ListQueues returning errors: AccessDenied (sqs:ListQueues not granted), RequestThrottled from account-level rate limits, AuthFailure/InvalidClientTokenId from bad credentials or wrong region, or network failures. Note: an empty prefix match is not an error (returns nil, nil).

Common situations: IAM policies granting only queue-level SQS actions but not sqs:ListQueues at account level; expired credentials mid-long deletion run; heavy throttling on accounts with very high SQS traffic; misconfigured region causing auth errors.

Related errors

• rendering policy as json: %w
• error deleting SQS queue %q: %w
• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/dd02411d9a25322d. Report an issue: GitHub.