Unable to create a Cloud9 Environment (Reason: Client.InternalError: Client error on launch)

Question

Hi,

I'm unable to create a Cloud9 Environment. Every time I try to create one, I receive the same error message "Instance i-XXXXXXXXXXXXXXXXX failed to stabilize. Current state: shutting-down. Reason: Client.InternalError: Client error on launch." I have conducted several tests using different types of instances, VPCs, security groups, connections, etc. (using both the AWS Console and AWS CLI), but I always receive the same error. However, when I switch to another region (such as us-east-1), I can create the Cloud9 Environment without any issues. I have checked various AWS documentation, but I have not found a possible solution.

Thank you

Answer

Which region are you using?

Answer

The most possible reason for this behavior is you might have Default KMS key in your "us-east-1" for EBS and have a custom key for other regions.

This Error corresponds to KMS and the worst part is CloudTrail is not showing these Access Deny's for CreateGrant, however it shows when it's success.

To resolve make sure you know which KMS key is set for EBS default Encryption and Apply Key Grant to Service Role(AWSServiceRoleForAWSCloud9) has Create grant permissions and you can only apply this from CLI as AWSServiceRoleForAWSCloud9 is a Service role.

CLI Command:
> aws kms create-grant --region  --key-id  --grantee-principal arn:aws:iam:::role/aws-service-role/cloud9.amazonaws.com/AWSServiceRoleForAWSCloud9 --operations "Encrypt" "Decrypt" "ReEncryptFrom" "ReEncryptTo" "GenerateDataKey" "GenerateDataKeyWithoutPlaintext" "DescribeKey" "CreateGrant"

Then you should be able to create environment with out issues.

Reference:
https://docs.aws.amazon.com/cloud9/latest/user-guide/move-environment.html#encrypting-volumes
https://docs.aws.amazon.com/kms/latest/developerguide/using-service-linked-roles.html

Unable to create a Cloud9 Environment (Reason: Client.InternalError: Client error on launch)

Relevant content