How can I resolve the error I get when my EC2 instances fail to communicate with Elastic Beanstalk?

Short description

Amazon Elastic Compute Cloud (Amazon EC2) instances must be configured to initiate outbound connections to Elastic Beanstalk and other service endpoints. To avoid the failed to communicate error, your EC2 instances must be configured to initiate outbound connections through one of the following:

• Public subnet (Internet Gateway)
• Private subnet (Nat Gateway)
• VPC endpoints

Resolution

1. Verify that the network ACL associated with your subnets allows outbound connections to the internet. For example: 0.0.0.0/0.
2. If you select a custom Amazon Virtual Private Cloud (Amazon VPC) when you create your Elastic Beanstalk environment, then choose the appropriate subnets. The subnets must allow for instance and load balancer visibility.
3. If your EC2 instances are in a public subnet, then verify that the route table has a route to the internet through an internet gateway. For example: 0.0.0.0/0.
4. Verify that the public subnet has "auto-assign public IPv4 address" turned on in the VPC subnets console. The VPC subnets console must display Auto-assign public IPv4 address: Yes.
5. If your EC2 instances are in a private subnet, then verify that the route table associated with the NAT gateway or the NAT instance has a route to the internet. For example: 0.0.0.0/0.
   Note: Your NAT gateway or NAT instance must be created in a public subnet to communicate with the internet.
6. Verify that the VPC attributes enableDnsHostnames and enableDnsSupport are turned on in the VPC where you launched your environment.
7. If your Elastic Beanstalk environment is using VPC endpoints, then set up the following endpoints to launch your environment properly:
   Amazon Simple Queue Service (Amazon SQS)
   AWS CloudFormation
   Elastic Beanstalk (elasticbeanstalk.region.amazonaws.com)
   Elastic Beanstalk Health (elasticbeanstalk-health.region.amazonaws.com)
   Amazon Simple Storage Service (Amazon S3) Gateway endpoint
   Note: If your environment must interact with other AWS services, then create the appropriate VPC endpoints for those services.
8. If you're using a custom AMI other than the Elastic Beanstalk-provided AMI, then make sure that you create the AMI so that EC2 instances can reach the internet.

Related information

Why can't my EC2 instance in a private subnet connect to the internet using a NAT gateway?

Route tables for your VPC