Home / AWS / Fix AWS EC2 Instance Connect Not Working

AWS

Fix AWS EC2 Instance Connect Not Working

Resolve EC2 Instance Connect failures by configuring IAM permissions, security groups, and Instance Connect endpoints properly.

Published: Apr 1, 20266 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

EC2 Instance Connect allows SSH access to instances without managing SSH keys. When it fails, you can't connect to your instance through the browser-based SSH or the Instance Connect CLI, even though the instance is running and reachable.

Symptoms

In the AWS Console:

bash

Failed to connect to your instance
Error establishing SSH connection. The SSH key was not found or is not authorized.

Via AWS CLI:

```bash $ aws ec2-instance-connect send-ssh-public-key --instance-id i-abc123 --availability-zone us-east-1a --instance-os-user ec2-user --ssh-public-key file://my-key.pub

An error occurred (AuthException) when calling the SendSSHPublicKey operation: User is not authorized ```

Common Causes

1.Missing IAM permissions - User/role lacks ec2-instance-connect:SendSSHPublicKey
2.Security group blocking - Port 22 not open to Instance Connect IP ranges
3.Instance Connect endpoint missing - No endpoint in the VPC for private instances
4.Instance ID not found - Wrong instance ID or instance terminated
5.OS user doesn't exist - Specified user doesn't exist on the instance
6.Instance not running - Instance is stopped or terminated
7.Wrong availability zone - Zone mismatch in the request

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check IAM Permissions

The IAM user or role needs permission to push SSH keys:

```bash # Check your current identity aws sts get-caller-identity

# Verify permissions aws iam simulate-principal-policy \ --policy-source-arn arn:aws:iam::123456789:user/myuser \ --action-names ec2-instance-connect:SendSSHPublicKey \ --resource-arns arn:aws:ec2:us-east-1:123456789:instance/i-abc123 ```

Required IAM policy:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2-instance-connect:SendSSHPublicKey",
        "ec2:DescribeInstances"
      ],
      "Resource": "*"
    }
  ]
}

Step 2: Verify Instance State

bash

aws ec2 describe-instances --instance-ids i-abc123 \
  --query 'Reservations[*].Instances[*].[State.Name,LaunchTime]'

Instance must be in running state.

Step 3: Configure Security Group

Instance Connect uses IP ranges that vary by region. The security group must allow SSH (port 22) from these ranges:

bash

# Get Instance Connect IP ranges for your region
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq '.prefixes[] | select(.service=="EC2_INSTANCE_CONNECT") | select(.region=="us-east-1") | .ip_prefix'

Add security group rule:

```bash # Get security group ID SG_ID=$(aws ec2 describe-instances --instance-ids i-abc123 \ --query 'Reservations[*].Instances[*].SecurityGroups[*].GroupId' --output text)

# Add inbound SSH rule for Instance Connect (example for us-east-1) # Note: Add each IP range separately aws ec2 authorize-security-group-ingress \ --group-id $SG_ID \ --protocol tcp \ --port 22 \ --cidr 18.206.107.24/29 ```

For browser-based SSH, also allow: - 13.107.42.0/24 (Microsoft Azure IP for browser) - Your organization's public IP if using console

Step 4: Set Up Instance Connect Endpoint (for Private Instances)

For instances in private subnets without internet access:

bash

# Create Instance Connect endpoint
aws ec2 create-instance-connect-endpoint \
  --subnet-id subnet-12345 \
  --security-group-id sg-12345

Wait for endpoint to become available:

bash

aws ec2 describe-instance-connect-endpoints \
  --filters Name=state,Values=create-complete

Connect through the endpoint:

bash

aws ec2-instance-connect ssh \
  --instance-id i-abc123 \
  --instance-connect-endpoint-id eice-12345 \
  --os-user ec2-user

Step 5: Verify OS User Exists

```bash # Get instance OS from metadata aws ec2 describe-instances --instance-ids i-abc123 \ --query 'Reservations[*].Instances[*].[PlatformDetails,ImageId]'

# Common OS users: # Amazon Linux 2: ec2-user # Ubuntu: ubuntu # Debian: admin or debian # RHEL: ec2-user or root # CentOS: centos # SUSE: ec2-user ```

If the user doesn't exist:

```bash # Connect via SSM if available aws ssm start-session --target i-abc123

# Create user sudo useradd -m -s /bin/bash myuser ```

Step 6: Push SSH Key Manually

```bash # Generate a key pair ssh-keygen -t rsa -b 2048 -f my-temp-key -N ""

# Push the public key aws ec2-instance-connect send-ssh-public-key \ --instance-id i-abc123 \ --availability-zone us-east-1a \ --instance-os-user ec2-user \ --ssh-public-key file://my-temp-key.pub

# Connect with private key ssh -i my-temp-key ec2-user@ec2-1-2-3-4.compute-1.amazonaws.com ```

Note: Keys pushed via Instance Connect are valid for 60 seconds.

Step 7: Check Instance Connect Agent

On the instance, verify Instance Connect is installed:

```bash # SSH via SSM or existing key # Check if EC2 Instance Connect is installed rpm -qa | grep ec2-instance-connect # Amazon Linux dpkg -l | grep ec2-instance-connect # Ubuntu

# If not installed, install it: # Amazon Linux 2 sudo yum install ec2-instance-connect -y

# Ubuntu sudo apt-get install ec2-instance-connect -y ```

Verify the service is running:

```bash # Check authorized_keys_command configuration cat /etc/ssh/sshd_config | grep AuthorizedKeysCommand

# Should show: # AuthorizedKeysCommand /opt/aws/bin/eic_run_authorized_keys %u %f # AuthorizedKeysCommandUser ec2-instance-connect ```

Step 8: Check Audit Logs

```bash # Check CloudTrail for Instance Connect events aws cloudtrail lookup-events \ --lookup-attributes AttributeKey=EventName,AttributeValue=SendSSHPublicKey \ --max-items 10

# Check instance console output aws ec2 get-console-output --instance-id i-abc123 --output text | grep -i ssh ```

Step 9: Test Connection

```bash # Using AWS CLI aws ec2-instance-connect ssh --instance-id i-abc123 --os-user ec2-user

# Using browser (console) # Navigate to EC2 Console > Instances > Select instance > Connect # Choose "EC2 Instance Connect" tab ```

Step 10: Troubleshoot Network ACLs

If security group is correct but connection still fails:

```bash # Get subnet's network ACL SUBNET_ID=$(aws ec2 describe-instances --instance-ids i-abc123 \ --query 'Reservations[*].Instances[*].SubnetId' --output text)

NACL_ID=$(aws ec2 describe-network-acls \ --filters Name=association.subnet-id,Values=$SUBNET_ID \ --query 'NetworkAcls[*].NetworkAclId' --output text)

# Check NACL rules aws ec2 describe-network-acls --network-acl-ids $NACL_ID \ --query 'NetworkAcls[*].Entries' ```

Ensure NACL allows: - Inbound TCP port 22 from Instance Connect IP ranges - Outbound ephemeral ports (1024-65535) to Instance Connect IP ranges

Verification

```bash # Test SSH connection aws ec2-instance-connect ssh --instance-id i-abc123 --os-user ec2-user --private-key-file ~/.ssh/my-key

# Should open SSH session successfully ```

[Fix AWS EC2 Systems Manager SSM Not Connected](/articles/fix-aws-ec2-systems-manager-ssm-not-connected)
[Fix AWS EC2 Instance Not Starting](/articles/fix-aws-ec2-instance-not-starting)
[Fix AWS EC2 Security Group Blocking](/articles/fix-aws-ec2-security-group-blocking)

[AWS troubleshooting: Fix IAM Permission Denied - Complete Tro](fix-iam-permission-denied)
[AWS cloud troubleshooting: AWS ACM Certificate Pending Validation Because the](aws-acm-certificate-pending-validation-wrong-route53-zone)
[AWS cloud troubleshooting: AWS ALB Returns 502 Because the Target Closed the ](aws-alb-502-target-closed-connection-keepalive-timeout-mismatch)
[AWS cloud troubleshooting: Fix AWS ALB CreateListener TargetGroupNotFound Err](aws-alb-createlistener-targetgroupnotfound)
[AWS cloud troubleshooting: Fix Aws Alb Lambda 502 Bad Gateway Issue in AWS](aws-alb-lambda-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

AWS EC2 Instance Connect Not Working AWS EC2 Instance Connect Not Working AWS AWS EC2 Instance Connect Not Working troubleshooting AWS EC2 Instance Connect Not Working fix Resolve EC2 Instance Connect failures by configuring IAM permissions, security groups, and Instance Connect endpoints properly AWS Resolve EC2 Instance Connect failures by configuring IAM permissions, security groups, and Instance Connect endpoints properly

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

AWS Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this aws-errors troubleshooting guide applies to my situation?

This guide is designed for aws-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these aws-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of aws-errors issue?

Most aws-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this aws-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for aws-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 1, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix AWS EC2 Instance Connect Not Working

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check IAM Permissions

Step 2: Verify Instance State

Step 3: Configure Security Group

Step 4: Set Up Instance Connect Endpoint (for Private Instances)

Step 5: Verify OS User Exists

Step 6: Push SSH Key Manually

Step 7: Check Instance Connect Agent

Step 8: Check Audit Logs

Step 9: Test Connection

Step 10: Troubleshoot Network ACLs

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix AWS EC2 Instance Connect Not Working

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check IAM Permissions

Step 2: Verify Instance State

Step 3: Configure Security Group

Step 4: Set Up Instance Connect Endpoint (for Private Instances)

Step 5: Verify OS User Exists

Step 6: Push SSH Key Manually

Step 7: Check Instance Connect Agent

Step 8: Check Audit Logs

Step 9: Test Connection

Step 10: Troubleshoot Network ACLs

Verification

Related Issues

Related Articles

People also search for

Share this guide

More AWS Troubleshooting Guides

Browse Guides from Other Categories

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading