Why can't I start or launch my Amazon EC2 instance for my Amazon EBS volume?

9 minute read

I can't launch a new Amazon Elastic Compute Cloud (Amazon EC2) instance or start an existing instance for my Amazon Elastic Block Store (Amazon EBS) volume.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

If you don't receive an error code when you start the instance, then check the AWS CloudTrail event history for the StartInstances event. Or, run the following describe-instances AWS CLI command:

aws ec2 describe-instances --instance-id MYINSTANCE --output json

Note: Replace MYINSTANCE with the ID of the instance that you can't start.

In the output, check the StateReason message. In the following example response, the StateReason is Client.InternalError:

"StateReason": {
    "Message": "Client.InternalError: Client error on launch",
    "Code": "Client.InternalError"
},

Based on the error that you receive, take the following troubleshooting actions.

"InsufficientInstanceCapacity" error

You receive the following error message when there isn't enough On-Demand Instance capacity to launch your new instance or restart your stopped instance:

"An error occurred (InsufficientInstanceCapacity) when calling the StartInstances operation (reached max retries: 4): Insufficient capacity.)"

To troubleshoot this issue, see How do I troubleshoot InsufficientInstanceCapacity errors when I start or launch an EC2 instance?

"InstanceLimitExceeded" error

You receive the following error message when you launch more than your maximum allowed instances in an AWS Region:

"InstanceLimitExceeded: Your quota allows for 0 more running instance(s)."

To troubleshoot this issue, see How do I troubleshoot InstanceLimitExceeded errors when starting or launching an EC2 instance?

"UnauthorizedOperation" error

You receive the "UnauthorizedOperation" error message when the user that launched the instance doesn't have the required permissions.

To troubleshoot this error, see How do I decode and analyze "You are not authorized to perform this operation" errors for Amazon EC2 instance launch failures?

"The requested configuration is currently not supported" error

You receive the "configuration is currently not supported" error message when the Availability Zone that you requested doesn't support your specified instance type.

To check the availability of the instance types in specific Availability Zones, run the following describe-instance-type-offerings command:

aws ec2 describe-instance-type-offerings --location-type availability-zone --filters Name=instance-type,Values=c5.2xlarge --region us-east-1

Note: Replace c5.2xlarge with your instance type and us-east-1 with the AWS Region of your Availability Zone.

If required, then launch the instance in a supported Availability Zone.

The error also occurs if the Amazon Machine Image (AMI) that you used to launch the instance doesn't support your selected instance type. The error typically occurs when you use the AWS CLI to launch an AWS Marketplace AMI.

Before you select the instance type, check the AMI listing on the AWS Marketplace for the Supported Instance Types section. Verify that your instance type or family appears in the list of supported types. If you use the Amazon EC2 console to launch your instance, then the console automatically filters out unsupported instance types.

"InternalError" error

The "InternalError" error typically occurs for the following reasons:

You incorrectly attached the Amazon EBS volume to the instance.
An Amazon EBS volume that's attached to the instance is in an ERROR state.
You attached an encrypted Amazon EBS volume to the instance, but you don't have permission to access the AWS Key Management Service (AWS KMS) decryption key.

To troubleshoot this error, see How do I troubleshoot an Amazon EC2 instance that stops or terminates when I try to start it with the "InternalError" or "Client.UserInitiatedShutdown" error?

"Disk full" error

You receive a "disk full" error message when you run out of space on an instance and the audit service stops the machine on boot.

Important: Before you stop and start your instance, take the following actions.

Create a snapshot of your Amazon EBS volume.
Note: If your instance is instance store-backed or has instance store volumes that contain data, then Amazon EC2 deletes the data when you stop the instance.
Temporarily detach the instance from its Auto Scaling group.
Note: If you stop an instance that's in an Auto Scaling group, then you might terminate the instance based on your scale-in protection settings. Instances that you launch with Amazon EMR, AWS CloudFormation, or AWS Elastic Beanstalk might be in an Auto Scaling group.
Set the instance shutdown behavior to Stop so that the instance doesn't terminate on shutdown.

Note: When you stop and start an instance, the instance's public IP address changes. It's a best practice to use an Elastic IP address to route external traffic to your instance instead of a public IP address.

To resolve "disk full" errors, complete the following steps:

Attach the root volume to a rescue instance

Open the Amazon EC2 console.
From the navigation pane, choose Instances, and then choose your instance.
Choose Instance state, and then choose Stop instance. When prompted for confirmation, choose Stop.
Detach the /dev/xvda Amazon EBS root volume from the stopped instance.
Launch a new rescue EC2 instance in the same Availability Zone as the original instance.
Attach the root volume to the rescue instance as a secondary device.
Note: When you attach secondary volumes, you can use different device names.
Use SSH to connect to your rescue instance.
To create a mount point directory for the new volume, run the following mkdir command:
```
sudo mkdir /mnt/rescue
```
Note: Replace /mnt/rescue with your mount point directory. You can use only sudo commands for instances that run on Linux.
To mount the volume to the new directory, run the following mount command:
```
sudo mount /dev/xvdf /mnt/rescue
```
Note: Replace /dev/xvdf with your device name and /mnt/rescue with your mount point directory. You can use only sudo commands for instances that run on Linux. If you don't know your device name, then run the lsblk command to view all available disk devices and their mount points.

Resolve the disk space issue and restore the instance

Increase the root volume size.
To extend the partition, run the following growpart command:
```
sudo growpart /dev/xvda 1
```
Note: Replace /dev/xvda with your device name and 1 with your partition number.
Extend the file system.
For XFS file systems, run the following command:
```
sudo xfs_growfs -d /
```
For ext4 file systems, run the following command:
```
sudo resize2fs /dev/xvda1
```
Note: Replace /dev/xvda1 with your partition name. To check your file system type, run the df -hT command. For more information, see Extend the file system after resizing an Amazon EBS volume.
To unmount the volume, run the following command:
```
sudo umount /mnt/rescue
```
Note: Replace /mnt/rescue with your mount point directory. You can use only sudo commands for instances that run on Linux.
Detach the volume from the rescue instance.
Attach the volume to the original instance with the /dev/xvda root device name.
Start the instance to confirm that it boots successfully.

To prevent the audit service from halting the machine when disk space runs out, replace HALT values with SUSPEND or ROTATE in /etc/audit/auditd.conf.
For Amazon Linux 1 (AL1), Amazon Linux 2 (AL2), and Amazon Linux 2023 (AL2023), include the following options in your audit configuration file:

max_log_file_action = ROTATE
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND

"InvalidParameterValue" error

You receive the "InvalidParameterValue" error message when you pass a parameter value that the Amazon EC2 API doesn't accept for the requested operation. The error message explains which parameter caused the failure. For example, if a root volume isn't attached to the instance at /dev/sda1 or /dev/xvda, then the instance doesn't start. Then, the CloudTrail event history shows an entry similar to the following example:

"An error occurred (InvalidParameterValue) when calling the StartInstances operation: Invalid value 'i-abcdefghxyz' for instanceId. Instance does not have a volume attached at root (/dev/sda1)"

To resolve this issue, change the parameter that's listed in the error message. For example, attach the root volume to the instance at /dev/sda1, and then start the instance. For more information, see Error codes for the Amazon EC2 API.

"Client.InternalError" error

You receive the "Client.InternalError" error message when the instance stops because of encrypted Amazon EBS volumes.

To check if a volume is encrypted, open the Amazon EC2 console, and then select Volumes. Volumes that are encrypted with an AWS KMS key show the label Encrypted in the Encryption column.

Review the system logs to check if the instance started to boot the operating system (OS). If the instance didn't boot the OS and the volumes are encrypted, then the AWS Identity and Access Management (IAM) role doesn't have AWS KMS key access permissions.

To verify the IAM permissions, complete the following steps:

To verify the StateReason error message and error code, run the following describe-instances command:

aws ec2 describe-instances --instance-id i-example-id --region example-region --query "Reservations[].Instances[].{StateReason:StateReason}" --output json

Note: Replace i-example-id with your instance ID and example-region with your AWS Region.

If an encrypted volume that's attached to the instance has permissions or policy issues, then you receive a client error and the following output:

[
  [
    {
      "StateReason": {
        "Code": "Client.InternalError",
        "Message": "Client.InternalError: Client error on launch"
      }
    }
  ]
]

Verify that the IAM role includes the following permissions:

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": [
            "kms:CreateGrant",
            "kms:Decrypt",
            "kms:DescribeKey",
            "kms:GenerateDataKeyWithoutPlainText",
            "kms:ReEncrypt"
        ],
        "Resource": [
            "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
        ]
    }
}

Note: For Resource, replace the Amazon Resource Name (ARN) values with the ARN values of your AWS KMS keys.

If you launched the instance indirectly through another service, then configure the key policy with the correct permissions.