How to Regain Access to Your EC2 Instance After Losing SSH Connectivity?

 · Nikhil S.
Last updated: May 22, 2024

Losing SSH access to your EC2 instance can be a troublesome experience, especially if it hosts critical applications or data and you need to urgently login to work on it. Fortunately, there are several methods to regain access without losing your valuable work. Here’s a detailed and consolidated guide to help you troubleshoot and restore SSH access to your EC2 instance.

Common Reasons for Losing SSH Access

Before diving into the recovery steps, let’s explore some common reasons why you might lose SSH access to your EC2 instance:

  1. Security Group Misconfiguration: The security group associated with your instance does not allow inbound SSH traffic.
  2. Network ACL Issues: Network ACL associated with your VPC subnet are blocking SSH traffic.
  3. Incorrect Key Pair: Using an incorrect or outdated key pair to connect to your instance.
  4. SSH Configuration Errors: Misconfiguration in the SSH settings on the EC2 instance itself.
  5. Instance State Issues: The instance is in a state that prevents SSH access, such as being stopped or in a recovery mode.
  6. Disk Space Issues: The instance's disk is full, preventing the SSH daemon from starting or operating correctly.
  7. IP Address Changes: The public IP address of your instance has changed (common with instances using a dynamic IP address).
  8. Firewall or VPN Issues: Local firewall rules or VPN settings on your client machine are blocking outbound SSH traffic.
  9. Instance Metadata Service Misconfiguration: Misconfiguration or restrictions on the instance metadata service, which might be affecting connectivity.
  10. IAM Role Issues: Misconfigured IAM roles or policies attached to the instance might restrict necessary operations.
  11. Operating System or Software Issues: An issue with the operating system or installed software that prevents SSH from functioning correctly.

Various Methods to Regain Access

Method 1: Check Security Group Settings

Ensure that your security group settings allow SSH access:

  1. Navigate to the EC2 Dashboard: Open the AWS Management Console and go to the EC2 Dashboard.
  2. Select Your Instance: Locate and select your EC2 instance from the list.
  3. View Security Groups: In the instance details, click on the security group associated with your instance.
  4. Edit Inbound Rules: Check the inbound rules to ensure that port 22 (SSH) is open to your IP address or a range of IP addresses.

Method 2: Verify the Key Pair

Ensure that you are using the correct key pair associated with your EC2 instance:

  1. Locate the Key Pair: Verify that you have access to the correct .pem file used when the instance was launched.
  2. Check Permissions: Ensure that the key file has the correct permissions:
 chmod 400 /path/to/your-key-pair.pem

Method 3: Use EC2 Instance Connect (for Amazon Linux 2 or Ubuntu)

If you have an Amazon Linux 2 or Ubuntu instance, you can use EC2 Instance Connect:

  1. Navigate to the EC2 Dashboard: Open the AWS Management Console and go to the EC2 Dashboard.
  2. Select Your Instance: Locate and select your EC2 instance.
  3. Connect Using EC2 Instance Connect: Click on the "Connect" button, then choose "EC2 Instance Connect." Follow the prompts to access your instance directly through the browser.

Method 4: Attach the Root Volume to Another Instance

If you cannot use the above methods, you can attach the root volume to another instance:

  1. Stop Your Instance: Stop the instance that you cannot access.
  2. Detach the Root Volume: In the EC2 Dashboard, select "Volumes" from the left-hand menu, find the root volume, and detach it.
  3. Attach to Another Instance: Attach the detached volume to another running EC2 instance as a secondary volume.
  4. Mount the Volume: SSH into the second instance and mount the attached volume to access the file system:
sudo mkdir /mnt/recovery
sudo mount /dev/xvdf1 /mnt/recovery  # Replace xvdf1 with your device name
  1. Modify Configuration: Navigate to the /mnt/recovery directory and modify configuration files, such as ~/.ssh/authorized_keys to restore SSH access.
  2. Detach and Reattach: After making necessary changes, detach the volume from the second instance and reattach it to the original instance as the root volume.
  3. Restart Your Instance: Start the original instance and try to SSH into it again.

Method 5: Utilize Systems Manager Session Manager

If you have Systems Manager Agent (SSM Agent) installed and IAM roles configured correctly, you can use Session Manager:

  1. Verify SSM Agent Installation: Ensure that the SSM Agent is installed and running on your instance.
  2. Attach IAM Role: Attach an IAM role with the necessary SSM permissions to your instance.
  3. Connect via Session Manager: Go to the EC2 Dashboard, select your instance, and choose "Connect" using Session Manager.

Method 6: Disable ufw Using User Data

If ufw (Uncomplicated Firewall) is causing access issues, you can disable it using user data:

  1. Stop the Instance: Stop the instance you cannot access.
  2. View/Change User Data: In the EC2 Dashboard, navigate to "Instance Settings" and select "View/Change User Data."
  3. Set User Data: Copy and set the following user data as plain text and save:
Content-Type: multipart/mixed; boundary="//"
MIME-Version: 1.0

--//
Content-Type: text/cloud-config; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="cloud-config.txt"

#cloud-config
cloud_final_modules:
- [scripts-user, once]

--//
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="userdata.txt"

#!/bin/bash
sudo ufw disable
--//
  1. Start the Instance: Start your instance. You should be able to SSH into your server now as ufw is disabled.
  2. Remove User Data: Once you have regained access, stop the instance, remove the user data, and start it again to ensure it doesn't run the script on every boot.

Conclusion

Regaining SSH access to your EC2 instance can be a multi-method or one method process, but by systematically checking and addressing each potential cause, you can identify and resolve the issue, restoring your access. Regular backups, monitoring configurations, and implementing best practices can help prevent such issues in the future.