diff --git a/pkg/apis/kops/validation/aws.go b/pkg/apis/kops/validation/aws.go
index 49eefd61e8..90eb38f6f5 100644
--- a/pkg/apis/kops/validation/aws.go
+++ b/pkg/apis/kops/validation/aws.go
@@ -28,7 +28,11 @@ import (
 func awsValidateCluster(c *kops.Cluster) field.ErrorList {
 	allErrs := field.ErrorList{}
 
-	allErrs = append(allErrs, awsValidateAdditionalSecurityGroups(field.NewPath("spec", "api", "loadBalancer", "additionalSecurityGroups"), c.Spec.API.LoadBalancer.AdditionalSecurityGroups)...)
+	if c.Spec.API != nil {
+		if c.Spec.API.LoadBalancer != nil {
+			allErrs = append(allErrs, awsValidateAdditionalSecurityGroups(field.NewPath("spec", "api", "loadBalancer", "additionalSecurityGroups"), c.Spec.API.LoadBalancer.AdditionalSecurityGroups)...)
+		}
+	}
 
 	return allErrs
 }