Common EC2 Errors
Overview
This section catalogs the most frequent errors when creating and using EC2 instances, along with their causes and solutions.
Instance Creation Errors
1. InsufficientInstanceCapacity
┌─────────────────────────────────────────────────────────────┐
│ InsufficientInstanceCapacity │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message : │
│ "We currently do not have sufficient capacity in the │
│ Availability Zone you requested" │
│ │
│ Cause : │
│ AWS no longer has available servers for this instance │
│ type in this specific AZ │
│ │
│ Solutions : │
│ 1. Try another AZ │
│ → us-east-1a → us-east-1b │
│ │
│ 2. Try another instance type │
│ → t3.micro → t3.small │
│ → t3.micro → t3a.micro (AMD) │
│ │
│ 3. Wait a few minutes and try again │
│ │
│ 4. Use Spot Instances (if interruption-tolerant) │
│ │
└─────────────────────────────────────────────────────────────┘
2. InstanceLimitExceeded
┌─────────────────────────────────────────────────────────────┐
│ InstanceLimitExceeded │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message : │
│ "You have requested more instances than your current │
│ instance limit allows" │
│ │
│ Cause : │
│ You have reached the maximum instance quota for your │
│ AWS account in this region │
│ │
│ Default limits (vary) : │
│ • On-Demand : ~20 instances per type │
│ • Spot : Variable depending on type │
│ │
│ Solutions : │
│ 1. Terminate unused instances │
│ │
│ 2. Request a quota increase │
│ → Service Quotas → EC2 → Request quota increase │
│ │
│ 3. Use another region │
│ │
└─────────────────────────────────────────────────────────────┘
3. InvalidParameterValue (AMI)
┌─────────────────────────────────────────────────────────────┐
│ InvalidParameterValue - AMI │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message : │
│ "Value (ami-xxxxxxxx) for parameter imageId is invalid" │
│ │
│ Possible causes : │
│ │
│ 1. Non-existent or deleted AMI │
│ → Check that the AMI still exists │
│ │
│ 2. AMI in another region │
│ → AMIs are regional! │
│ → ami-xxx in us-east-1 ≠ ami-xxx in eu-west-1 │
│ │
│ 3. Private AMI without permission │
│ → You do not have access to this AMI │
│ │
│ Solution : │
│ Verify the AMI ID in the correct region │
│ │
└─────────────────────────────────────────────────────────────┘
4. InvalidGroup.NotFound
┌─────────────────────────────────────────────────────────────┐
│ InvalidGroup.NotFound │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message : │
│ "The security group 'sg-xxxxxxxx' does not exist" │
│ │
│ Possible causes : │
│ │
│ 1. Security Group deleted │
│ │
│ 2. Security Group in another VPC │
│ → SGs are tied to a specific VPC │
│ │
│ 3. Incorrect Security Group ID │
│ │
│ Solution : │
│ aws ec2 describe-security-groups --group-ids sg-xxx │
│ │
└─────────────────────────────────────────────────────────────┘
5. InvalidSubnetID.NotFound
┌─────────────────────────────────────────────────────────────┐
│ InvalidSubnetID.NotFound │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message : │
│ "The subnet ID 'subnet-xxxxxxxx' does not exist" │
│ │
│ Causes : │
│ • Subnet deleted │
│ • Subnet in another region │
│ • Incorrect subnet ID │
│ │
│ Solution : │
│ Check available subnets : │
│ aws ec2 describe-subnets │
│ │
└─────────────────────────────────────────────────────────────┘
Connectivity Errors
6. SSH Timeout
┌─────────────────────────────────────────────────────────────┐
│ SSH Connection Timeout │
├─────────────────────────────────────────────────────────────┤
│ │
│ Symptom : │
│ ssh: connect to host X.X.X.X port 22: Connection timed out│
│ │
│ Diagnostic : │
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ 1. Instance running ? │ │
│ │ └── Check status in the console │ │
│ │ │ │
│ │ 2. Public IP ? │ │
│ │ └── Does the instance have a public IP ? │ │
│ │ └── Does the subnet have "auto-assign public IP" ? │ │
│ │ │ │
│ │ 3. Security Group ? │ │
│ │ └── Port 22 open ? │ │
│ │ └── Is your IP allowed ? │ │
│ │ │ │
│ │ 4. NACL ? │ │
│ │ └── Incoming traffic on port 22 allowed ? │ │
│ │ └── Outgoing traffic on ephemeral ports allowed ?│ │
│ │ │ │
│ │ 5. Route Table ? │ │
│ │ └── Route to Internet Gateway ? │ │
│ │ │ │
│ │ 6. Internet Gateway ? │ │
│ │ └── IGW attached to the VPC ? │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────┘
7. Permission Denied (publickey)
┌─────────────────────────────────────────────────────────────┐
│ Permission Denied (publickey) │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message : │
│ Permission denied (publickey,gssapi-keyex,gssapi-with-mic)│
│ │
│ Checklist : │
│ │
│ □ Correct private key ? │
│ └── Verify it is the key associated with the instance │
│ │
│ □ Correct user ? │
│ └── Amazon Linux : ec2-user │
│ └── Ubuntu : ubuntu │
│ └── Debian : admin │
│ └── RHEL : ec2-user │
│ │
│ □ Key permissions ? │
│ └── chmod 400 my-key.pem │
│ │
│ □ Instance launched with a key ? │
│ └── Cannot connect if no key associated │
│ │
└─────────────────────────────────────────────────────────────┘
8. Connection Refused (port 22)
┌─────────────────────────────────────────────────────────────┐
│ Connection Refused │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message : │
│ ssh: connect to host X.X.X.X port 22: Connection refused │
│ │
│ Difference with Timeout : │
│ • Timeout = Packet does not arrive (network/firewall) │
│ • Refused = Packet arrives but port closed │
│ │
│ Causes : │
│ 1. SSH service not started on the instance │
│ → Check with EC2 Serial Console │
│ │
│ 2. Instance not ready yet │
│ → Wait for Status Checks to pass │
│ │
│ 3. OS Firewall (iptables) │
│ → SSH blocked at the instance level │
│ │
└─────────────────────────────────────────────────────────────┘
Instance State Errors
9. Instance Stuck in Pending
┌─────────────────────────────────────────────────────────────┐
│ Instance Stuck in Pending │
├─────────────────────────────────────────────────────────────┤
│ │
│ Symptom : │
│ Instance remains in "pending" state for more than 10 │
│ minutes │
│ │
│ Possible causes : │
│ 1. AWS capacity issue │
│ 2. Problem with the AMI │
│ 3. Problem with the root EBS volume │
│ │
│ Solutions : │
│ 1. Terminate and relaunch in another AZ │
│ 2. Try a different AMI │
│ 3. Contact AWS support if it persists │
│ │
└─────────────────────────────────────────────────────────────┘
10. Instance Immediately Terminates
┌─────────────────────────────────────────────────────────────┐
│ Instance Terminates Immediately │
├─────────────────────────────────────────────────────────────┤
│ │
│ Symptom : │
│ Instance goes from pending → running → terminated │
│ in a few seconds │
│ │
│ Diagnostic : │
│ EC2 → Instances → Select → Description │
│ → State transition reason │
│ │
│ Common causes : │
│ │
│ "Client.VolumeLimitExceeded" │
│ → Too many EBS volumes │
│ │
│ "Client.InternalError" │
│ → Problem with the AMI (corrupted) │
│ │
│ "Server.InternalError" │
│ → AWS-side problem, try again │
│ │
│ "Client.InvalidSnapshot.NotFound" │
│ → AMI snapshot deleted │
│ │
└─────────────────────────────────────────────────────────────┘
11. Status Check Failed
┌─────────────────────────────────────────────────────────────┐
│ Status Check Failed │
├─────────────────────────────────────────────────────────────┤
│ │
│ Two types of Status Checks : │
│ │
│ SYSTEM STATUS CHECK │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ Checks : AWS infrastructure │ │
│ │ • Physical network │ │
│ │ • Hypervisor │ │
│ │ • Power supply │ │
│ │ │ │
│ │ If failure : │ │
│ │ → AWS problem, not your fault │ │
│ │ → Stop/Start the instance (migrate to another host) │ │
│ │ → Or wait for AWS to resolve │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
│ INSTANCE STATUS CHECK │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ Checks : Your configuration │ │
│ │ • OS responding │ │
│ │ • Instance network configuration │ │
│ │ • File system │ │
│ │ │ │
│ │ If failure : │ │
│ │ → Problem with your configuration │ │
│ │ → Check system logs │ │
│ │ → Check the disk (full?) │ │
│ │ → Check network config in the OS │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────┘
Summary Table
| Error | Probable Cause | Quick Solution |
|---|---|---|
| InsufficientCapacity | No servers available | Change AZ or type |
| InstanceLimitExceeded | Quota reached | Terminate or request quota |
| InvalidAMI | Wrong ID or region | Check AMI in the region |
| SSH Timeout | Network/SG | Check SG port 22 |
| Permission Denied | Wrong key/user | Check key and user |
| Instance Terminates | AMI/EBS issue | Check state transition reason |
| Status Check Failed | Infra or config | Stop/Start or debug OS |
Validation Quiz
- What is the difference between SSH timeout and connection refused?
- What does "InsufficientInstanceCapacity" mean?
- How to find the reason for an immediate termination?
- What is the SSH user for Ubuntu?
- What to do if System Status Check fails?
Next section: Diagnostic Method