D

AWS EC2 Cannot Connect

Diagnose an EC2 instance that refuses SSH or application connections.

On this page

Confirm the instance is actually running

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query 'Reservations[].Instances[].State.Name'

An instance that's stopped, terminated, or still initializing will refuse every connection regardless of networking config.

Check the security group

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

Confirms an inbound rule actually allows the port you're connecting on, from the IP you're connecting from.

Your IP probably isn't what you think

A security group rule scoped to a specific IP breaks the moment that IP changes — home ISP reassignment, a VPN reconnect, a new office. Check your current public IP against the rule before assuming something else broke.

Check the route table and internet gateway

If connecting from outside the VPC, the instance's subnet needs a route to an Internet Gateway (for a public IP) or you need to be connecting through a VPN/Direct Connect/bastion into the VPC instead.

aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=subnet-0123456789abcdef0

Confirms the subnet actually routes to an internet gateway, if you expect public connectivity.

Check the NACL

aws ec2 describe-network-acls --filters Name=association.subnet-id,Values=subnet-0123456789abcdef0

Unlike a security group, a NACL is stateless — confirm both the inbound rule AND a matching outbound rule for the return traffic exist.

Check the instance's own firewall and service

If networking checks out, the problem may be inside the instance — the OS firewall (iptables/firewalld), or the target service not actually listening.

aws ssm start-session --target i-0123456789abcdef0

Connects via Session Manager (works even with security groups blocking SSH inbound, as long as the instance has the SSM agent and role) to check the service locally.

SSH specifically failing?

Confirm the username matches the AMI (ec2-user for Amazon Linux, ubuntu for Ubuntu, admin for Debian) and the key pair matches what the instance was actually launched with — a wrong username or key produces a connection-refused-looking failure that has nothing to do with networking at all.