OpsAtlas™OPERATIONAL RUNBOOKS
Free AWS Sample

Amazon EC2 Instance Unreachable

Preview the OpsAtlas™ runbook format directly on the page, then download the PDF version or open the full product pack when you are ready.

Download PDF sampleView AWS packBack to catalog

Amazon EC2 Instance Unreachable

AWS Troubleshooting Runbook 01 Audience: Cloud administrators, SREs, support personnel, and MSP escalation teams Severity guide: Sev 1 when production access, customer traffic, or protected data recovery is blocked; Sev 2 when impact is partial or a workaround exists. Incident objective: Restore administrative or application access by isolating instance state, status checks, OS boot, security groups, NACLs, routing, public/private addressing, and service listener failures.

Operator note: Capture request IDs, ARNs, regions, timestamps, and before/after configuration evidence. Prefer the smallest reversible change that restores service, then replace emergency access with a durable fix.

Common Symptoms

  • SSH, RDP, HTTP, or application access times out.
  • EC2 status checks fail or the console screenshot shows boot/login issues.
  • Access broke after patching, resizing, security group changes, or route updates.

First 15 Minutes

  • Confirm instance state, system status, and instance status checks.
  • Review console screenshot, system log, and recent CloudTrail/EC2 events.
  • Validate security group inbound/outbound rules, subnet route table, NACLs, and public/private IP expectations.
  • Check whether the target service is listening inside the OS and whether host firewall rules allow it.
  • Snapshot important EBS volumes before invasive repair.

Command Starters

Replace placeholders before running. Use the correct AWS account, region, profile, and role. Record output in the incident ticket.

aws ec2 describe-instance-status --instance-ids <instance-id> --include-all-instances
aws ec2 get-console-output --instance-id <instance-id> --latest
aws ec2 describe-security-groups --group-ids <sg-id>
aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=<subnet-id>
aws ec2 describe-network-acls --filters Name=association.subnet-id,Values=<subnet-id>

Decision Path

If you find...Do this next
System status check failedTreat as AWS infrastructure/host path; stop/start if acceptable or move workload to healthy capacity.
Instance status check failedInspect OS boot, disk, networking agent, CPU/memory, or filesystem issues.
Network path blockedFix SG, NACL, route, IGW/NAT/TGW, or source/destination check as applicable.
Host reachable but app downMove to process, listener, dependency, certificate, and local firewall checks.

Remediation Actions

  • Use EC2 Instance Connect, Session Manager, or a bastion instead of opening SSH/RDP broadly.
  • Stop/start to move hardware only after capturing evidence and considering instance-store data loss.
  • Use EC2Rescue or detach/attach EBS root volume for OS-level repair.
  • Replace broad emergency SG rules with scoped rules after recovery.

Validation Checklist

  • Status checks are 2/2 and application probe succeeds from the expected source.
  • Security group/NACL changes match the access standard.
  • Monitoring and owner validation confirm workload recovery.

Evidence to Attach

  • Account ID, region, affected ARNs, request IDs, and UTC timestamps.
  • CloudTrail, CloudWatch, service event, health, or target-status evidence.
  • Before/after IAM, network, routing, DNS, health check, or service configuration.
  • Approval record for any emergency permission, public exposure, route, restart, failover, replay, or rollback.

Customer-Facing Summary Template

What happened: <brief customer-safe description> Impact: <users/services/regions affected and time range> Root cause: <confirmed root cause or current leading cause> Resolution: <fix applied and validation completed> Prevention: <monitoring, guardrail, IaC, policy, or architecture follow-up>

Reference Anchors