View a markdown version of this page

Error codes for the Amazon EC2 API - Amazon Elastic Compute Cloud
Common client error codesClient error codes for specific actionsServer error codesExample error responseEventual consistency

Error codes for the Amazon EC2 API

Amazon EC2 has two types of error codes:

  • Client errors. These errors are usually caused by something the client did. Common causes include specifying an incorrect or invalid parameter in the request, or using an action or resource on behalf of a user that doesn't have permission to use the action or resource. These errors are accompanied by a 400-series HTTP response code.

  • Server errors. These errors are usually caused by an AWS server-side issue. These errors are accompanied by a 500-series HTTP response code.

Common client error codes

This section lists the client error codes that all Amazon EC2 API actions can return.

Error code Description
AuthFailure The provided credentials could not be validated. You might not be authorized to carry out the request; for example, trying to associate an Elastic IP address that is not yours, or trying to use an AMI for which you do not have permissions. Ensure that your account is authorized to use Amazon EC2, that your credit card details are correct, and that you are using the correct credentials.
Blocked Your account is currently blocked. Contact Support if you have questions.
DryRunOperation The user has the required permissions, so the request would have succeeded, but the DryRun parameter was used.
IdempotentParameterMismatch The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.
IncompleteSignature The request signature does not conform to AWS standards.
InvalidAction The action or operation requested is not valid. Verify that the action is typed correctly.
InvalidCharacter A specified character is invalid.
InvalidClientTokenId The X.509 certificate or credentials provided do not exist in our records.
InvalidPaginationToken The specified pagination token is not valid or is expired.
InvalidParameter A parameter specified in a request is not valid, is unsupported, or cannot be used. The returned message provides an explanation of the error value. For example, if you are launching an instance, you can't specify a security group and subnet that are in different VPCs.
InvalidParameterCombination Indicates an incorrect combination of parameters, or a missing parameter. For example, trying to terminate an instance without specifying the instance ID.
InvalidParameterDependency Indicates an incorrect combination of parameters, or a missing parameter. For example, trying to terminate an instance without specifying the instance ID.
InvalidParameterValue A value specified in a parameter is not valid, is unsupported, or cannot be used. Ensure that you specify a resource by using its full ID. The returned message provides an explanation of the error value.
InvalidQueryParameter The AWS query string is malformed or does not adhere to AWS standards.
MalformedQueryString The query string contains a syntax error.
MissingAction The request is missing an action or a required parameter.
MissingAuthenticationToken The request must contain valid credentials.
MissingParameter The request is missing a required parameter. Ensure that you have supplied all the required parameters for the request; for example, the resource ID.
OptInRequired You are not authorized to use the requested service. Ensure that you have subscribed to the service you are trying to use. If you are new to AWS, your account might take some time to be activated while your credit card details are being verified.
PendingVerification Your account is pending verification. Until the verification process is complete, you may not be able to carry out requests with this account. If you have questions, contact Support.
RequestExpired The request reached the service more than 15 minutes after the date stamp on the request or more than 15 minutes after the request expiration date (such as for presigned URLs), or the date stamp on the request is more than 15 minutes in the future. If you're using temporary security credentials, this error can also occur if the credentials have expired. For more information, see Temporary security credentials in the IAM User Guide.
TagPolicyViolation You attempted to create or update a resource with tags that are not compliant with the tag policy requirements for this account. For more information, see Grant permission to tag resources during creation.
UnauthorizedOperation You are not authorized to perform this operation. Check your IAM policies, and ensure that you are using the correct credentials. For more information, see Identity and access management for Amazon EC2. If the returned message is encoded, you can decode it using the DecodeAuthorizationMessage action. For more information, see DecodeAuthorizationMessage in the AWS Security Token Service API Reference.
UnknownParameter An unknown or unrecognized parameter was supplied. Requests that could cause this error include supplying a misspelled parameter or a parameter that is not supported for the specified API version.
UnsupportedInstanceAttribute The specified attribute cannot be modified.
UnsupportedOperation The specified request includes an unsupported operation. For example, you can't stop an instance that's instance store-backed. Or you might be trying to launch an instance type that is not supported by the specified AMI. The returned message provides details of the unsupported operation.
UnsupportedProtocol SOAP has been deprecated and is no longer supported.
ValidationError The input fails to satisfy the constraints specified by an AWS service.

Client error codes for specific actions

This section lists client errors that are specific to certain Amazon EC2 API actions.

Error code Description
AccountDisabled The functionality you have requested has been administratively disabled for this account.
ActiveVpcPeeringConnectionPerVpcLimitExceeded You've reached the limit on the number of active VPC peering connections you can have for the specified VPC.
AddressLimitExceeded You've reached the limit on the number of Elastic IP addresses that you can allocate.

For more information, see Elastic IP address limit.
AsnConflict The Autonomous System Numbers (ASNs) of the specified customer gateway and the specified virtual private gateway are the same.
AttachmentLimitExceeded

You've reached the limit on the number of Amazon EBS volumes or network interfaces that can be attached to a single instance.

The number of Amazon EBS volumes that you can attach to an instance depends on the instance type. For more information, see Amazon EBS volume limits for Amazon EC2 instances in the Amazon EC2 User Guide.
BootForVolumeTypeUnsupported The specified volume type cannot be used as a boot volume. For more information, see Amazon EBS volume types.
BundlingInProgress The specified instance already has a bundling task in progress.
CannotDelete You cannot delete the 'default' security group in your VPC, but you can change its rules. For more information, see Amazon EC2 security groups.
CapacityBlockDescribeLimitExceeded You've reached the limit for this account. The returned message provides details.
ClientInvalidParameterValue A parameter specified in a request is not valid, is unsupported, or cannot be used. The returned message provides an explanation of the error value. For example, if you are launching an instance, you can't specify a security group and subnet that are in different VPCs.
ClientVpnAuthorizationRuleLimitExceeded You've reached the limit on the number of authorization rules that can be added to a single Client VPN endpoint.
ClientVpnCertificateRevocationListLimitExceeded You've reached the limit on the number of client certificate revocation lists that can be added to a single Client VPN endpoint.
ClientVpnEndpointAssociationExists The specified target network is already associated with the Client VPN endpoint.
ClientVpnEndpointLimitExceeded You've reached the limit on the number of Client VPN endpoints that you can create.
ClientVpnRouteLimitExceeded You've reached the limit on the number of routes that can be added to a single Client VPN endpoint.
ClientVpnTerminateConnectionsLimitExceeded The number of client connections you're attempting to terminate exceeds the limit.
ConcurrentCreateImageNoRebootLimitExceeded

The maximum number of concurrent CreateImage requests for the instance has been reached. Wait for the current CreateImage requests to complete, and then retry your request.
ConcurrentSnapshotLimitExceeded You've reached the limit on the number of concurrent snapshots you can create on the specified volume. Wait until the 'pending' requests have completed, and check that you do not have snapshots that are in an incomplete state, such as 'error', which count against your concurrent snapshot limit.
ConcurrentTagAccess You can't run simultaneous commands to modify a tag for a specific resource. Allow sufficient wait time for the previous request to complete, then retry your request.
CreditSpecificationUpdateInProgress The default credit specification for the instance family is currently being updated. It takes about five minutes to complete. For more information, see Set the default credit specification for the account.
CustomerGatewayLimitExceeded You've reached the limit on the number of customer gateways you can create for the AWS Region. For more information, see Amazon VPC quotas.
CustomerKeyHasBeenRevoked The KMS key cannot be accessed. For more information, see Amazon EBS encryption.
DeclarativePoliciesAccessDeniedException You do not have sufficient access to perform this action, or the specified TargetId does not exist, or the specified TargetId is not in your organization. To generate an account status report for declarative policies, the caller must be the management account or a delegated administrator for the organization and the specified TargetId must belong to your organization.
DeclarativePoliciesNotEnabledException Trusted access is not enabled. Trusted access must be enabled for the service for which the declarative policy will enforce a baseline configuration. The API uses the following service principal to identify the EC2 service: ec2.amazonaws.com. For more information on how to enable trusted access with the AWS CLI and AWS SDKs, see Using Organizations with other AWS services.
DeleteConversionTaskError The conversion task cannot be canceled.
DefaultSubnetAlreadyExistsInAvailabilityZone A default subnet already exists in the specified Availability Zone. You can have only one default subnet per Availability Zone.
DefaultVpcAlreadyExists A default VPC already exists in the AWS Region. You can only have one default VPC per Region.
DefaultVpcDoesNotExist There is no default VPC in which to carry out the request. If you've deleted your default VPC, you can create a new one. For more information, see Create a default VPC.
DependencyViolation The specified object has dependent resources. A number of resources in a VPC may have dependent resources, which prevent you from deleting or detaching them. Remove the dependencies first, then retry your request. For example, this error occurs if you try to delete a security group in a VPC that is in use by another security group.
DiskImageSizeTooLarge The disk image exceeds the allowed limit (for instance or volume import).
DuplicateSubnetsInSameZone For an interface VPC endpoint, you can specify only one subnet per Availability Zone.
EncryptedVolumesNotSupported Encrypted Amazon EBS volumes may only be attached to instances that support Amazon EBS encryption. For more information, see Amazon EBS encryption.
ExistingVpcEndpointConnections You cannot delete a VPC endpoint service configuration or change the load balancers for the endpoint service if there are endpoints attached to the service.
FleetNotInModifiableState The Spot Fleet request must be in the active state to modify it. For more information, see Spot Fleet request types.
FlowLogAlreadyExists A flow log with the specified configuration already exists.
FlowLogsLimitExceeded You've reached the limit on the number of flow logs you can create. For more information, see Amazon VPC quotas.
FilterLimitExceeded The request uses too many filters or too many filter values.
Gateway.NotAttached An internet gateway is not attached to a VPC. If you are trying to detach an internet gateway, ensure that you specify the correct VPC. If you are trying to associate an Elastic IP address with a network interface or an instance, ensure that an internet gateway is attached to the relevant VPC.
HostAlreadyCoveredByReservation The specified Dedicated Host is already covered by a reservation.
HostLimitExceeded You've reached the limit on the number of Dedicated Hosts that you can allocate. For more information, see Dedicated Hosts.
IdempotentInstanceTerminated The request to launch an instance uses the same client token as a previous request for which the instance has been terminated.
InaccessibleStorageLocation The specified Amazon S3 URL cannot be accessed. Check the access permissions for the URL.
InaccessibleStorageLocationException The specified Amazon S3 bucket can't be accessed. An S3 bucket must be available before generating an account status report for declarative policies (you can create a new one or use an existing one), you must own the bucket, it must be in the same Region in which the request was made, and it must have an appropriate bucket policy. For a sample S3 policy, see Sample Amazon S3 policy.
IncorrectInstanceState The instance is in an incorrect state for the requested action. For example, some instance attributes, such as user data, can only be modified if the instance is in a 'stopped' state.

If you are associating an Elastic IP address with a network interface, ensure that the instance that the interface is attached to is not in the 'pending' state.
IncorrectModificationState A new modification action on an EBS Elastic Volume cannot occur because the volume is currently being modified.
IncorrectSpotRequestState The Spot Instance request is in an incorrect state for the request. Spot request status information can help you track your Amazon EC2 Spot Instance requests. For more information, see Spot request status.
IncorrectState The resource is in an incorrect state for the request. This error can occur if you are trying to attach a volume that is still being created or detach a volume that is not in the 'available' state. Verify that the volume is in the 'available' state. If you are creating a snapshot, ensure that the previous request to create a snapshot on the same volume has completed. If you are deleting a virtual private gateway, ensure that it's detached from the VPC.
IncorrectStateException

The resource is in an incorrect state for the request. This error can occur if you're trying to cancel the generation of an account status report for declarative policies that already has the complete, cancelled, or error status. Cancelation is only possible for reports with a running status. This error can also occur when you're trying to get a summary for a report that has not yet reached the completed status. This error can also occur if you start report generation while another report is being generated. Only one report per organization can be generated at a time. For more information, see Generating the account status report for declarative policies.