Fix: AWS EC2 Instance Unreachable via SSH

!Symptoms

• SSH connection times out: 'Connection timed out'
• SSH connection refused: 'Connection refused'
• Instance is Running in console but unreachable
• Cannot ping the instance public IP

?Root Causes

• Security group does not allow inbound SSH (port 22) from your IP
• Network ACL blocking traffic
• Instance has no public IP or Elastic IP assigned
• SSH daemon (sshd) is not running on the instance
• Wrong key pair being used for authentication
• Instance is in a private subnet without NAT gateway or bastion

#Diagnosis Steps

1. 1Check instance state in AWS Console: should be 'running' with status checks passed
2. 2Check security group rules: `aws ec2 describe-security-groups --group-ids <sg-id>`
3. 3Verify the instance has a public IP: `aws ec2 describe-instances --instance-ids <id> --query 'Reservations[].Instances[].PublicIpAddress'`
4. 4Check VPC route table for internet gateway route
5. 5Use EC2 Instance Connect or SSM Session Manager as alternative access
6. 6Check system log: `aws ec2 get-console-output --instance-id <id>`

>Fix

1. 1Add inbound SSH rule to security group: `aws ec2 authorize-security-group-ingress --group-id <sg-id> --protocol tcp --port 22 --cidr <your-ip>/32`
2. 2Assign a public IP or Elastic IP if the instance lacks one
3. 3Fix Network ACL to allow inbound/outbound on port 22
4. 4Use SSM Session Manager for access without SSH: `aws ssm start-session --target <instance-id>`
5. 5If sshd is down, use EC2 user data or instance connect to restart it

*Prevention

• Use SSM Session Manager instead of direct SSH for better security
• Restrict SSH access to specific IPs, not 0.0.0.0/0
• Set up a bastion host or VPN for private subnet access
• Monitor instance status checks and set up auto-recovery
• Use infrastructure as code to manage security groups consistently

Related Error Messages