How do I troubleshoot connection issues to AWS service endpoints from Amazon EC2 Linux?

Resolution

Troubleshoot the AWS service endpoint connection

Confirm routing and DNS resolution

To connect to an AWS service endpoint, first check how your instance resolves the AWS service endpoint through DNS tools.

Run the nslookup command:

nslookup ec2.us-east-1.amazonaws.com

Note: Replace ec2 with the AWS service and us-east-1 with your AWS Region. For a list of Regions, see AWS service endpoints.

To confirm your routing and DNS resolution, check the following AWS service endpoint connections:

• If the resolved IP address is within the CIDR range for your virtual private cloud (VPC), then you connected privately through a VPC endpoint.
• If the resolved IP address is outside your VPC's CIDR range, then you connected to the AWS service endpoint through the public internet. You either connected through an internet gateway or NAT Gateway.
• If you expected a private IP address and you received a public IP address, then the VPC or VPC endpoint settings might not be configured to allow the private DNS resolution.
• If you receive the error message server can't find...NXDOMAIN, then review the endpoint and make sure that it matches the respective service endpoint documentation. Make sure that your DNS server allows the service endpoint to resolve.

Connect to the AWS service endpoint

To connect to AWS service endpoints, use TCP port 443 (HTTPS), and then test your connection.

Run the telnet command:

telnet ec2.us-east-1.amazonaws.com 443

Or, use the netcat (nc) tool:

nc -vz ec2.us-east-1.amazonaws.com 443

Note: In the previous commands, replace ec2 with the name of your service and us-east-1 with your AWS Region.

If the telnet command successfully connects you to the endpoint, then you receive a message similar to Connected to ec2.us-east-1.amazonaws.com. The netcat tool (nc) returns a Connection to ec2.us-east-1.amazonaws.com (X.X.X.X) 443 port [tcp/https] succeeded! message.

If you receive a Connection timed out or Operation timed out error from the previous commands, then make sure that the connection allows the traffic. Check the following configurations:

• Third-party firewalls or security appliances in your VPC or Linux instances. Make sure that they don't block outbound TCP 443 traffic from the Linux instance or the ephemeral traffic that returns to the instance.
• EC2 security groups and network ACLs. Check that the outbound traffic (TCP 443) is allowed out of the Linux instance from the EC2 security group and network access control list (network ACL). Verify that the return ephemeral traffic is allowed back into the same subnet from the network ACL inbound rules.
• VPC Network Firewall. Check whether you have a VPC Network Firewall that doesn't allow this traffic (TCP 443 outbound, ephemeral traffic inbound).
• VPC endpoint policy. If you use a VPC endpoint, then make sure that the policy associated with the VPC endpoint allows connection to the AWS service endpoint.
  Note: This applies only if you use a VPC endpoint.
• Interface VPC endpoint. If you use an interface VPC endpoint to access the AWS service, then review the inbound rules for its security group. Make sure that it allows TCP 443 access from the Linux instance's security group or IP address.
  Note: This applies only if you use an interface VPC endpoint.
• Gateway VPC endpoints. If you use a gateway VPC endpoint, then make sure that the Linux instance's subnet route table is activated for the gateway VPC endpoint.
  Note: This applies only if you use a gateway VPC endpoint.

Related information

How do I configure security groups and network ACLs when creating a VPC interface endpoint for endpoint services?

Example: Control access to instances in a subnet

Using DNS Firewall to filter outbound DNS traffic

Common errors

Filter network traffic using AWS Network Firewall