Root user gets AccessDenied on Lightsail StartInstance, but StopInstance works

Question

I'm experiencing a strange issue with AWS Lightsail and would appreciate any insight.

**Environment**

Service: AWS Lightsail
Region: ap-northeast-2
Logged in as the AWS root user with MFA enabled

**Problem**

The root user can successfully stop the instance, but cannot start it again.

When attempting to start the instance from the Lightsail console, I receive:

StartInstance [ap-northeast-2]

Sorry, you don't have permission to do this.

Error code: 400

CloudTrail records the StartInstance event with:

errorCode: AccessDenied
errorMessage: Sorry, you don't have permission to do this.

However, the same root user successfully executed StopInstance just a few minutes earlier.

Additionally, AWS CloudShell cannot be created and displays:

"Unable to create the environment. Your account verification is in progress."

At the same time, the Customer Verification page says:

"You are not required to complete customer verification of your account at this time."

What I've already checked

Logged in as the AWS root user (not an IAM user)
MFA enabled
Region is correct (ap-northeast-2)
Instance is stopped and visible in the console
This does not appear to be an IAM policy issue because the root user can stop the instance but receives AccessDenied when starting it.

Questions

1) Has anyone seen StartInstance blocked for the root user while StopInstance still works?
2) Could this be caused by an AWS account verification or internal account restriction?
3) Is there anything I can check on my side, or is this something only AWS Support can resolve?

Thanks in advance for any suggestions.

Taka · Accepted Answer

1. Please open an AWS Support case with the highest priority. If you select the "Account and billing" category, you can open a case for free, even on the Basic plan.
2. Be sure to include the following details in the case:
* The specific discrepancy where `StopInstance` succeeds, but `StartInstance` returns `AccessDenied`.
* The fact that you are using the root user with MFA enabled (this serves as evidence that the issue is unlikely to be caused by an IAM policy).
* The fact that a "Processing account authentication" error is simultaneously occurring in CloudShell (this is the most critical piece of related information; similar restrictions appearing across two different services at the same time strongly suggest a common, account-level cause).
* The contradiction where the customer verification page indicates that no verification is required.
3. If there is an impact on your production environment, clearly state this in the case to convey the urgency. There are reports on re:Post indicating that when business impact is communicated, AWS flags the case internally for priority handling.

It is highly likely that the root cause of this issue is an internal "pending" status affecting the entire account, rather than a mistake in your configuration or operations. By reporting the CloudShell issue within the same support case, you make it easier for AWS to recognize this as an "account-level problem" rather than an "isolated glitch."

Root user gets AccessDenied on Lightsail StartInstance, but StopInstance works

Add your answer

Relevant content