Why does my Amazon EC2 Windows instance get a "Waiting for the metadata service" error?

Resolution

My instance that's in a VPC is inaccessible or is failing instance status checks

If your instance is in a virtual private cloud (VPC), then attach a second elastic network interface. Use the instance to provide the required route and a valid IP address. Then, you can access the instance on the second network interface and resolve network configuration issues on the primary network interface.

Note: If you change the instance type when you add a second network interface, then make sure that you use a compatible instance type.

My instance passes both status checks and is accessible

Run the route print command from Windows PowerShell. Review the output to check for a route that's similar to the following example:

Network Address Netmask          Gateway Address
169.254.169.254  255.255.255.255  Subnet Router Address

Important: Before you complete the following steps, it's a best practice to back up your Amazon Elastic Block Storage (Amazon EBS) volume and route table.

If there's no route or the Gateway Address doesn't match your existing subnet, then complete the following steps:

1. Verify that you have the latest version of EC2Config or EC2Launch installed on your instance:
   For Windows Server 2012 or earlier, install the latest EC2Config version.
   For Windows Server 2016 or later, use the latest EC2Launch v2 version. If you use EC2Launch v1, then see Install the latest version of EC2Launch.
2. Apply the route to the instance based on the software that you use:
   For EC2config, restart the EC2config Service.
   For EC2Launch v1, run the following command from an elevated PowerShell session:

   Import-Module c:\ProgramData\Amazon\EC2-Windows\Launch\Module\Ec2Launch.psm1 ; Add-Routes

   For EC2Launch v2, restart the EC2 Launch service.

If the route exists but the instance still can't retrieve metadata, then check your instance's Windows Firewall, third-party firewall, and antivirus configuration. Make sure that traffic to 169.254.169.254 isn't explicitly denied.