EC2 instance from Snapshot not accessible

Question

I need to duplicate an EC2 instance to trial run an OS upgrade. The original, running EC2 instance that gets a daily snapshot taken.  I created an AMI from the latest snapshot and launched a new instance from the AMI.  I tried to configure the instance with the same details as the original instance.  However with the new instance running it is not accessible via the web or SSH.  In both cases the connection times out.  It strikes me as an issue with security groups, but I've triple checked and the new instance is using the same security groups as the original instance (which include SSH and Web traffic).  Any ideas on how to troubleshoot this?

re:Post Agent · Accepted Answer

There are several potential reasons why your new EC2 instance created from a snapshot is not accessible. While you've already checked the security groups, which is a good first step, there are other areas to investigate:

1. Network Configuration: Ensure that the new instance is in a public subnet with a route to an Internet Gateway. Check that the instance has a public IP address assigned to it.

2. VPC and Subnet Settings: Verify that the VPC and subnet configurations are correct and that your instance has a valid route to the internet.

3. Network ACLs: If you're using a custom VPC, check that the Network ACLs allow inbound and outbound traffic for SSH (port 22) and web traffic (typically port 80 or 443).

4. Route Table: Confirm that the route table associated with your subnet has a route to the internet gateway (0.0.0.0/0).

5. Instance Status: Verify that the instance is in a "running" state and has passed all status checks in the EC2 console.

6. System Logs: Examine the system logs in the EC2 console for any error messages or indications of what might be causing the connection issues.

7. Elastic IP: If the original instance was using an Elastic IP, remember that this doesn't automatically transfer to the new instance. You may need to associate the Elastic IP with the new instance or assign a new public IP.

8. OS-level Firewall: The snapshot might have captured a state where the OS-level firewall (like iptables for Linux) was configured to block incoming connections. You may need to modify these settings.

9. Instance Connect: Try connecting using EC2 Instance Connect through the AWS Management Console. This method doesn't rely on your local SSH key and might work even if traditional SSH is failing.

If none of these steps resolve the issue, you might want to consider:

- Creating another new instance in a different subnet or VPC to isolate the problem.
- Using AWS Systems Manager Session Manager for access if it's configured.
- As a last resort, you may need to stop and start the instance, which will migrate it to a new host. Be aware that this will change the public IP address if you're not using an Elastic IP.

Remember to make changes one at a time and test after each modification to identify which change resolves the issue. If the problem persists after trying these steps, it may be worth contacting AWS support for more in-depth assistance.  
**Sources**  
[Why can't I connect via SSH to my EC2 instance? | AWS re:Post](https://repost.aws/questions/QUg8n4FIGBTP2rayRCs7akxw/why-can-t-i-connect-via-ssh-to-my-ec2-instance)  
[Error establishing SSH connection to your instance. Access to EC2 has been lost | AWS re:Post](https://repost.aws/questions/QUNEm4wAkISBKsMHWcK4n9zg/error-establishing-ssh-connection-to-your-instance-access-to-ec2-has-been-lost)  
[Unable to connect to EC2 Instance | AWS re:Post](https://repost.aws/questions/QUit6wCA2sTJu0vi4omxwVeA/unable-to-connect-to-ec2-instance)  
[Unable to SSH into AWS EC2 Instance – Connection Timed Out & Forgot Credentials | AWS re:Post](https://repost.aws/questions/QU_efyLS20R-eb94Mz8an0wQ/unable-to-ssh-into-aws-ec-2-instance-connection-timed-out-forgot-credentials)

Brandon Ancelin · Answer

Hello,  
Make sure that you create the new instance from your snapshot in the same subnet and using the same security group to be sure that is not a related to a network issue.

Have you tried with different snapshots?

Riku_Kobayashi · Answer

Hello.

It may be that the sshd process is not starting properly due to some influence or that a firewall is enabled in the OS.  
How about running commands to restart sshd and disable the firewall in your user data when restoring from a snapshot?  
You may also want to try connecting using Systems Manager Session Manager, as mentioned in the answer to AWS re:Post Agent.  
https://repost.aws/knowledge-center/ec2-linux-resolve-ssh-connection-errors

I think the user data script can restart sshd and disable the firewall in the following way.  
```
Content-Type: multipart/mixed; boundary="//"
MIME-Version: 1.0

--//
Content-Type: text/cloud-config; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="cloud-config.txt"

#cloud-config
cloud_final_modules:
- [scripts-user, always]

--//
Content-Type:
    text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="userdata.txt"

#!/bin/bash
iptables -P INPUT ACCEPT
iptables -F
sudo systemctl disable firewalld
sudo apt remove --purge fifewalld
sudo disable ufw
systemctl restart sshd.service || service sshd restart
if [[ $( cat /etc/hosts.[ad]* | grep -vE '^#' | awk 'NF' | wc -l) -ne 0 ]];\
then sudo sed -i '1i sshd2 sshd : ALL: allow' /etc/hosts.allow; fi
--//
```

EC2 instance from Snapshot not accessible

Add your answer

Relevant content