PacketSensei

AWS `AddressLimitExceeded`: What It Means and How to Fix It

PacketSensei

AddressLimitExceeded is the Elastic IP quota — five per region by default, and usually full of addresses nothing is using. It comes from EC2, and the message reads:

The maximum number of addresses has been reached.

If you are here mid-incident, skip to how to tell which cause you have — the command there narrows it down faster than reading the list.

Quick reference
Error AddressLimitExceeded
Service EC2
Message The maximum number of addresses has been reached.
Most common cause Unassociated addresses left behind

What it actually means

Elastic IPs are a scarce, quota-limited resource: five per region by default. The quota is raisable, but before raising it, look at what is holding the current five, because unassociated Elastic IPs are both a cost and a quota consumer.

AWS charges for every allocated Elastic IP, including — since 2024 — ones that are attached to running instances. An unassociated address is pure waste on both counts.

Why it happens

Ranked by how often each one turns out to be the answer.

# Cause Fix
1 Unassociated addresses left behind Terminated instances release their EIP association but not the allocation. These accumulate silently.
2 One EIP per NAT gateway per AZ A three-AZ VPC uses three before anything else does. Two such VPCs exhaust the default quota on their own.
3 Genuinely needing more than five Raise the quota — it is routinely approved.
4 A NAT gateway or load balancer holding addresses you forgot about They allocate EIPs on your behalf and count against the quota.

How to tell which one you have

# Every allocation, and what it is attached to. Blank = wasted.
aws ec2 describe-addresses \
  --query 'Addresses[].{IP:PublicIp,Alloc:AllocationId,Instance:InstanceId,ENI:NetworkInterfaceId}' \
  --output table

# Just the unassociated ones.
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId]' --output text

# Current quota
aws service-quotas get-service-quota --service-code ec2 --quota-code L-0263D0A3

Preventing it

Release unassociated addresses as part of routine cleanup, and treat an EIP with no association as a defect rather than a spare.

Prefer alternatives where you can: an Application Load Balancer needs no EIP, a NAT gateway allocates its own, and outbound-only traffic from private subnets needs none at all. The cases that genuinely require a stable public IP — an allow-listed source address, a mail server — are fewer than the number of EIPs most accounts hold.

Quota codes, limits and behaviour on this page were last checked against AWS documentation on 2026-08-22. AWS changes these; if something here does not match what you are seeing, trust the console and tell us.