AWS · Troubleshooting guide

AWS Troubleshooting: EC2 Reachability Failures, S3 AccessDenied and EBS Volumes That Fill Up

Practical diagnosis order for the incidents AWS admins face weekly: unreachable instances, denied S3 calls, and disk extension mistakes.

Published August 28, 2026 · RCW IT Training

EC2 networking

Instance fails status checks or is unreachable after launch

Verify in order: the security group allows your IP on the right port, the route table has 0.0.0.0/0 to an Internet Gateway, the subnet NACL allows return ephemeral ports 1024-65535, and the instance actually has a public IP. Use VPC Reachability Analyzer and Flow Logs to see where packets die. '2/2 checks failed' usually means the guest OS crashed - read the system log in the EC2 console.

SSH works from one network but not another

Your corporate egress IP changed, or the security group references an old one. Compare curl ifconfig.me from the client with the rules, prefer prefix lists, and keep SSM Session Manager (aws ssm start-session) as a fallback so IP churn never locks you out.

S3 and EBS

S3 returns 403 AccessDenied although the IAM policy looks right

Four layers can deny you: the IAM identity policy, the bucket policy, bucket ACLs plus Public Access Block, and organization SCPs. The error XML names the principal; check aws s3api get-bucket-policy and PAB settings, and remember s3:ListBucket targets the bucket ARN while s3:GetObject targets ARN/* - a very common mix-up.

EBS volume extended in the console but the OS still shows the old size

The console only grows the block device; the guest must extend the partition and filesystem. Rescan the device (or reboot), then growpart /dev/nvme1n1 1 followed by xfs_growfs / or resize2fs /dev/nvme1n1p1. Check lsblk before and after - and extend at 80% full, not after the filesystem fills and corrupts.

Key takeaway: Diagnose AWS top-down - security group, routes, NACLs, OS - and remember S3 has four independent deny layers. EBS grows in two places: the console and the guest.