AWS `Client.InternalError`: What It Means and How to Fix It
Client.InternalError is an instance that terminates immediately after launch — nearly always a KMS key it cannot use. It comes from EC2, and the message reads:
Client.InternalError: Client error on launch
If you are here mid-incident, skip to how to tell which cause you have — the command there narrows it down faster than reading the list.
Quick reference
| Error | Client.InternalError |
| Service | EC2 |
| Message | Client.InternalError: Client error on launch |
| Most common cause | The KMS key policy does not grant the launching principal access |
What it actually means
The instance transitions to terminated almost immediately with this as the state transition reason. Despite the wording, it is not an AWS internal fault: it is EC2 being unable to decrypt an encrypted EBS volume because the KMS key is unavailable to it.
The message is unhelpfully generic, and the real cause is in the KMS key policy rather than anywhere you would think to look.
Why it happens
Ranked by how often each one turns out to be the answer.
| # | Cause | Fix |
|---|---|---|
| 1 | The KMS key policy does not grant the launching principal access | The key policy must allow kms:Decrypt, kms:GenerateDataKeyWithoutPlaintext, and kms:CreateGrant. Identity policy alone is not enough — KMS requires the key policy to permit it. |
| 2 | The KMS key is disabled or pending deletion | aws kms describe-key --key-id <id> --query KeyMetadata.KeyState. |
| 3 | An encrypted AMI shared across accounts without sharing the key | The AMI is shared, the snapshot is shared, and the customer-managed key is not. All three are separate grants. |
| 4 | Auto Scaling using the service-linked role without a key grant | The AWSServiceRoleForAutoScaling role needs explicit access in the key policy to launch instances from an encrypted AMI. This is the most common production instance of this error. |
| 5 | A cross-region copy referencing a key in the wrong region | KMS keys are regional. A launch template referencing a key ARN from another region fails here. |
How to tell which one you have
# The real reason lives in the state transition reason.
aws ec2 describe-instances --instance-ids i-0123456789abcdef0 \
--query 'Reservations[].Instances[].[State.Name,StateReason.Message,StateTransitionReason]' \
--output text
# Is the key usable at all?
aws kms describe-key --key-id <key-id> --query 'KeyMetadata.[KeyState,Enabled]'
# Read the key policy — this is where the fix goes.
aws kms get-key-policy --key-id <key-id> --policy-name default \
--output text | python3 -m json.toolCloudTrail will show a Decrypt or CreateGrant call being denied at the same timestamp, which confirms it.
Preventing it
When you create a customer-managed key for EBS encryption, write the Auto Scaling service-linked role into the key policy at the same time. Doing it later means doing it during an outage.
For cross-account AMI sharing, treat it as three artefacts: share the AMI, share the snapshot, and grant the key. Missing any one produces this error.
Related errors
InsufficientInstanceCapacity— EC2UnauthorizedOperation— EC2- All AWS error references — the full index
Quota codes, limits and behaviour on this page were last checked against AWS documentation on 2026-08-22. AWS changes these; if something here does not match what you are seeing, trust the console and tell us.