How do I troubleshoot the "Waiting for the metadata service" error on my Amazon EC2 Windows instance?

Resolution

Take the following troubleshooting actions based on your configuration.

My instance that's in a VPC is inaccessible or fails instance status checks

If your EC2 instance is in a virtual private cloud (VPC), then attach a second elastic network interface to the instance. Then, use the instance to provide the required route and a valid IP address. Use the second network interface to access the instance and resolve network configuration issues on the primary network interface.

Note: If you change the instance type when you add a second network interface, then make sure that you use a compatible instance type.

My instance passes both status checks and is accessible

Important: Before you complete the following steps, it's a best practice to back up your Amazon Elastic Block Store (Amazon EBS) volume and route table.

Run the route print command from Windows PowerShell. Review the output to check for a route that's similar to the following example:

Network Address Netmask          Gateway Address
169.254.169.254  10.255.255.255  Subnet Router Address

If there's no route or the Gateway Address doesn't match your existing subnet, then complete the following steps:

1. Verify that you installed the latest version of EC2Config or EC2Launch on your instance:
   For Windows Server 2012 or earlier, use the latest EC2Config version.
   For Windows Server 2016 or later, use the latest EC2Launch v2 version. If you use EC2Launch v1, then see Install the latest version of EC2Launch.

2. Apply the route to the instance based on the software that you use.
   For EC2Config, restart the EC2Config Service.
   For EC2Launch v1, run the following command from an elevated PowerShell session:

   Import-Module c:\ProgramData\Amazon\EC2-Windows\Launch\Module\Ec2Launch.psm1 ; Add-Routes

   For EC2Launch v2, proceed to the next steps.

3. (EC2Launch v2 only) To verify the agent service startup type, run the following command:

   Get-Service -Name "Amazon EC2Launch" | select -property name,starttype

   In the output, if the StartType value isn't Automatic, then run the following command to set the default value:

   Set-Service -Name "Amazon EC2Launch" -StartupType Automatic

4. (EC2Launch v2 only) To manually add the routes to the current boot, run the following command:

   & "C:\Program Files\Amazon\EC2Launch\EC2Launch.exe" run-task add-routes

If the route exists but the instance still can't retrieve metadata, then check your instance's Windows Firewall, third-party firewall, and antivirus configuration. Make sure that they don't explicitly deny traffic to 169.254.169.254.