Why did Amazon EC2 unexpectedly terminate my instance?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

On-Demand Instances

Note: You might still incur charges after Amazon EC2 deletes your instance.

To review information about when and how Amazon EC2 deleted your On-Demand Instance, check your AWS CloudTrail event history for the TerminateInstances event. Or, in the CloudTrail console, choose Resource name, and then enter your instance ID to view all API calls that are related to your instance. Check the event details for information about what time the instance terminated and what user terminated the instance.

Note: You can use AWS CloudTrail to search event history for only the past 90 days. For more information, see How do I use CloudTrail to review what API calls and actions have occurred in my AWS account?

Amazon EC2 might also terminate your On-Demand instances for the following reasons:

• Operating system (OS) shutdown
• Instance launch failures
• Third-party software termination

OS level shutdown

You can set the shutdown behavior of your EC2 instance to Terminate. In this scenario, when you run an OS-level shutdown command such as shutdown or poweroff on the instance, Amazon EC2 terminates the instance. CloudTrail doesn't record an event when Amazon EC2 deletes your instance this way.

To check the shutdown behavior of your instance, run the following describe-instance-attribute AWS CLI command:

aws ec2 describe-instance-attribute --instance-id example-instance-id --attribute instanceInitiatedShutdownBehavior

Note: Replace example-instance-id with your instance ID.

If you set the DeleteOnTermination attribute to False and retained the root volume, then use a rescue instance to check the OS-level logs, such as /var/log/messages logs or /var/log/audit/audit.log. This allows you to identity who ran the shutdown command and when. For steps on how to launch a rescue instance, see Use a rescue instance to manually edit the file in Why does my EC2 Linux instance go into emergency mode when I try to boot it?

EC2 instance launch failure

When you launch an EC2 instance, it might fail to start or get automatically terminated for the following reasons:

• You didn't correctly attach the Amazon Elastic Block Store (Amazon EBS) volume to the instance.
• The Amazon EBS volume that's attached to the EC2 instance is in an Error status.
• You attached an encrypted EBS volume to the instance, but don't have permissions to access the AWS Key Management Service (AWS KMS) decryption key.

Third-party software termination

Third-party software might terminate your EC2 instances for various reasons. Check whether the Amazon Resource Name (ARN) or AWS Identity and Access Management (IAM) user that ran the TerminateInstances event is related to your third-party software.

For example, Karpenter has disruption controls that can delete your EC2 instances. For more information, see Interruption on the Karpenter website.

Spot Instances

If the Spot Instance price increases above your bid price, then you lose your Spot Instance capacity. Or, if Amazon EC2 can't meet the Spot request constraints, then Amazon EC2 terminates the Spot Instance.

To determine whether Amazon EC2 terminated a Spot Instance, check your CloudTrail event history for BidEvictedEvent events.

Instances in Amazon EC2 Auto Scaling groups

Amazon EC2 Auto Scaling might terminate instances in an Amazon EC2 Auto Scaling group for the following reasons:

• The EC2 instance is marked as unhealthy.
• There's an Amazon EC2 Auto Scaling group scale-down event.

Note: By default, AWS Elastic Beanstalk environments use Amazon EC2 Auto Scaling groups to launch EC2 instances.

Related information

How do I recreate a terminated EC2 instance?

Troubleshoot Amazon EC2 instance termination issues