kubernetes/kops · error

error modifying VPC attribute: %v

Error message

error modifying VPC attribute: %v

What it means

When changes.EnableDNSSupport is set, RenderAWS calls ModifyVpcAttribute to enable/disable DNS support on the VPC. Any API failure is wrapped with this message; the VPC exists but its DNS attribute update failed.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:220

		}

		response, err := t.Cloud.EC2().CreateVpc(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating VPC: %v", err)
		}

		e.ID = response.Vpc.VpcId
	}

	if changes.EnableDNSSupport != nil {
		request := &ec2.ModifyVpcAttributeInput{
			VpcId:            e.ID,
			EnableDnsSupport: &ec2types.AttributeBooleanValue{Value: changes.EnableDNSSupport},
		}

		_, err := t.Cloud.EC2().ModifyVpcAttribute(ctx, request)
		if err != nil {
			return fmt.Errorf("error modifying VPC attribute: %v", err)
		}
	}

	if changes.EnableDNSHostnames != nil {
		request := &ec2.ModifyVpcAttributeInput{
			VpcId:              e.ID,
			EnableDnsHostnames: &ec2types.AttributeBooleanValue{Value: changes.EnableDNSHostnames},
		}

		_, err := t.Cloud.EC2().ModifyVpcAttribute(ctx, request)
		if err != nil {
			return fmt.Errorf("error modifying VPC attribute: %v", err)
		}
	}

	return t.AddAWSTags(*e.ID, e.Tags)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure IAM policy allows ec2:ModifyVpcAttribute
2. Enable manually if policy forbids automation: `aws ec2 modify-vpc-attribute --vpc-id <id> --enable-dns-support '{"Value":true}'`
3. Re-run kops apply if the error was transient (throttling)
4. Confirm the VPC ID still exists

Example fix

// before: SCP blocks ModifyVpcAttribute
// after: pre-enable via approved change process, then skip flag
export KOPS_FEATURE_FLAGS=VPCSkipEnableDNSSupport

out, _ := ec2Client.DescribeVpcAttribute(ctx, &ec2.DescribeVpcAttributeInput{VpcId: vpcID, Attribute: ec2types.VpcAttributeNameEnableDnsSupport})
// skip the change if already desired state
if fi.ValueOf(out.EnableDnsSupport) == desired { return nil }

err := kopsApply()
if err != nil && strings.Contains(err.Error(), "error modifying VPC attribute") {
	// fallback: enable attribute manually via approved change, or set VPCSkipEnableDNSSupport
}

When it happens

Trigger: EC2 ModifyVpcAttribute fails: VPC deleted concurrently, throttling, unauthorized IAM (ec2:ModifyVpcAttribute), or SCP denying vpc:* modifications in shared-account setups.

Common situations: Applying to a shared/corporate VPC governed by an account that forbids attribute modification; transient throttling during large applies; VPC removed between find and apply.

Related errors

• error listing subnets: %v
• error creating AutoScalingGroup: %s
• error fetching DNS HostedZone %q: %v
• error listing DNS HostedZones: %v
• error fetching DNS HostedZone by id %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5d6f33fe9a8d1669. Report an issue: GitHub.