kubernetes/kops · error

error listing subnets in VPC %q: %v

Error message

error listing subnets in VPC %q: %v

What it means

Returned by DescribeSubnets (aws_cloud.go:1917) when ec2.DescribeSubnets filtered by vpc-id fails while kops enumerates subnets in the VPC to populate subnet info (IDs and CIDRs). The AWS error is embedded in the message.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1917

	}
	if vpc == nil {
		return nil, nil
	}

	vpcInfo := &fi.VPCInfo{
		CIDR: aws.ToString(vpc.CidrBlock),
	}

	// Find subnets in the VPC
	{
		klog.V(2).Infof("Calling DescribeSubnets for subnets in VPC %q", vpcID)
		request := &ec2.DescribeSubnetsInput{
			Filters: []ec2types.Filter{NewEC2Filter("vpc-id", vpcID)},
		}

		response, err := c.EC2().DescribeSubnets(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing subnets in VPC %q: %v", vpcID, err)
		}
		if response != nil {
			for _, subnet := range response.Subnets {
				subnetInfo := &fi.SubnetInfo{
					ID:   aws.ToString(subnet.SubnetId),
					CIDR: aws.ToString(subnet.CidrBlock),
					Zone: aws.ToString(subnet.AvailabilityZone),
				}

				vpcInfo.Subnets = append(vpcInfo.Subnets, subnetInfo)
			}
		}
	}

	return vpcInfo, nil
}

func (c *awsCloudImplementation) GetApiIngressStatus(cluster *kops.Cluster) ([]fi.ApiIngressStatus, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS message: AccessDenied → add ec2:DescribeSubnets to the policy; Throttling → retry with backoff
2. Reproduce manually: `aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpcID> --region <region>`
3. Verify credentials/region match the account that owns (or is granted access to) the VPC
4. For shared VPCs, ensure the caller account has EC2 describe permissions via RAM sharing

Example fix

// before
# AccessDenied: ec2:DescribeSubnets
// after
{"Effect":"Allow","Action":["ec2:DescribeSubnets","ec2:DescribeVpcs"],"Resource":"*"}

// Pre-flight: confirm subnets in the VPC are describable
out, err := ec2Client.DescribeSubnets(ctx, &ec2.DescribeSubnetsInput{
	Filters: []ec2types.Filter{ec2filter("vpc-id", vpcID)},
})
if err != nil { return fmt.Errorf("cannot list subnets in %s: %w", vpcID, err) }

subnets, err := cloud.DescribeSubnets(ctx, vpcID)
if err != nil {
	if strings.Contains(err.Error(), "UnauthorizedOperation") { /* fix IAM then retry */ }
	if strings.Contains(err.Error(), "Throttling") { /* backoff then retry */ }
	return err
}

When it happens

Trigger: DescribeSubnets with Filter vpc-id=<vpcID> errors: missing ec2:DescribeSubnets IAM permission, invalid VPC ID, throttling, credentials/region problems, or network failure to the EC2 endpoint.

Common situations: IAM read-only policies omitting DescribeSubnets; VPC shared from another account (RAM) with limited visibility; transient throttling during parallel operations; VPC ID typo'd in the cluster spec.

Related errors

• error listing subnets: %v
• Unable to tag subnet %v
• error creating InternetGateway: %v
• error listing images: %v
• error checking if instance type %q is supported in region %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/48b2fb94d7bc7d69. Report an issue: GitHub.