How do I troubleshoot issues with my Elastic IP address on my Amazon EC2 instances?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Take the following troubleshooting actions based on the Elastic IP address issue that you encounter.

I want to restore an accidentally deleted Elastic IP address

You can't recover an Elastic IP address that you released. However, you might be able to recover the instance's public IP address. For more information, see How do I recover the public IP address or Elastic IP address associated with an EC2 instance?

If you can't recover the IP address, then allocate a new Elastic IP address.

To prevent accidental Elastic IP address in future, tag your Elastic IP addresses so that you can track them. You can also configure an Amazon CloudWatch alarm for the UnassociatedAmazonOwnedElasticIPs metric to check whether you have unused Elastic IP addresses.

I terminated my instance but the associated Elastic IP address didn't release

Note: Elastic IP addresses that you allocate to a virtual private cloud (VPC) incur costs, even if you haven't associated them with an instance.

When you terminate an instance, Amazon EC2 doesn't automatically release the associated Elastic IP address. Instead, you must manually disassociate the Elastic IP address from its resources to release it. Then, release the Elastic IP address. Or, to use the Elastic IP address for another resource, reassociate the Elastic IP address.

To verify that you released the Elastic IP address, run the following describe-addresses AWS CLI command:

aws ec2 describe-addresses --region your-region

Note: Replace your-region with your AWS Region.

Make sure that the Elastic IP address that you released isn't listed in the output.

I receive an error when I allocate a new Elastic IP address

If you exceed your Elastic IP address quota, then you receive the following error message when you try to allocate a new Elastic IP address:

"Elastic IP address could not be allocated. The maximum number of addresses has been reached"

All AWS accounts have a maximum quota of five Elastic IP addresses in each AWS Region.

The check how many Elastic IP addresses you use, run the following describe-addresses command:

aws ec2 describe-addresses --region your-region

Note: Replace your-region with your Region.

In the output, check for Elastic IP addresses where the Association ID is blank to identify IP addresses that aren't associated with an instance. Also, check for Elastic IP addresses that are associated with terminated instances. Release the Elastic IP addresses that you don't require.

If you require additional Elastic IP addresses, then request a quota increase and configure the following settings:

• For AWS Services, select Amazon Elastic Compute Cloud (Amazon EC2).
• Choose EC2-VPC Elastic IPs.
• Choose Request increase at account-level.

I receive an error when I associate an Elastic IP address to one of my instances

Your user or role lacks must have the required AWS Identity and Access Management (IAM) permissions to associate an Elastic IP address. If you don't have the required permissions, then you receive the following error message:

"Elastic IP address could not be associated. You are not authorized to perform this operation"

To confirm that you have the required permissions to associate an Elastic IP address, attach the following IAM policy to your IAM user or role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:AllocateAddress",
        "ec2:AssociateAddress",
        "ec2:DisassociateAddress",
        "ec2:DescribeAddresses"
      ],
      "Resource": "*"
    }
  ]
}

I receive an error when I release an Elastic IP address from my account

If you release an Elastic IP address that an AWS Managed Services (AMS) supported service uses, then you receive the following error message:

"Elastic IP address could not be released. You do not have permission to access the specified resource."

To resolve this issue, make sure that you disassociated the Elastic IP address from its resource. Then, to release an Elastic IP address that's associated with a service that AMS supports, delete the resource that uses it. For example, if you attached an Elastic IP address to a NAT gateway, then delete the NAT gateway. Then, you can release the Elastic IP address.

You might also receive the "could not be released" error message if you don't have the required permissions to release an IP address. Make sure that your IAM user or role has the ec2:ReleaseAddress and ec2:DisassociateAddress permissions.

I want to understand the best practices to manage Elastic IP address

To manage your Elastic IP address, use the following best practices:

• Tag your Elastic IP addresses so that you can track them.
• Configure a CloudWatch alarm for the UnassociatedAmazonOwnedElasticIPs metric to check whether you have unused Elastic IP addresses.
• Frequently audit your Elastic IP addresses.
• Set up an AWS Lambda function to automatically release unassociated Elastic IP addresses.
• Keep a database of your Elastic IP address allocation.