When I try to create an AWS Elastic Beanstalk environment, I get the error: "The EC2 instances failed to communicate with AWS Elastic Beanstalk, either because of configuration problems with the VPC or a failed EC2 instance. Check your VPC configuration and try launching the environment again."
Amazon Elastic Compute Cloud (Amazon EC2) instances must be configured to initiate outbound connections to Elastic Beanstalk and other service endpoints. To avoid the failed to communicate error, your EC2 instances must be configured to initiate outbound connections through one of the following:
- Verify that the network ACL associated with your subnets allows outbound connections to the internet. For example: 0.0.0.0/0.
- If you select a custom Amazon Virtual Private Cloud (Amazon VPC) when you create your Elastic Beanstalk environment, then choose the appropriate subnets. The subnets must allow for instance and load balancer visibility.
- If your EC2 instances are in a public subnet, then verify that the route table has a route to the internet through an internet gateway. For example: 0.0.0.0/0.
- Verify that the public subnet has "auto-assign public IPv4 address" turned on in the VPC subnets console. The VPC subnets console must display Auto-assign public IPv4 address: Yes.
- If your EC2 instances are in a private subnet, then verify that the route table associated with the NAT gateway or the NAT instance has a route to the internet. For example: 0.0.0.0/0.
Note: Your NAT gateway or NAT instance must be created in a public subnet to communicate with the internet.
- Verify that the VPC attributes enableDnsHostnames and enableDnsSupport are turned on in the VPC where you launched your environment.
- If your Elastic Beanstalk environment is using VPC endpoints, then set up the following endpoints to launch your environment properly:
Amazon Simple Queue Service (Amazon SQS)
Elastic Beanstalk (elasticbeanstalk.region.amazonaws.com)
Elastic Beanstalk Health (elasticbeanstalk-health.region.amazonaws.com)
Amazon Simple Storage Service (Amazon S3) Gateway endpoint
Note: If your environment must interact with other AWS services, then create the appropriate VPC endpoints for those services.
- If you're using a custom AMI other than the Elastic Beanstalk-provided AMI, then make sure that you create the AMI so that EC2 instances can reach the internet.
Why can't my EC2 instance in a private subnet connect to the internet using a NAT gateway?
Route tables for your VPC