#troubleshooting
Diagnosing AWS failures from the error message backwards: what the message means, the ranked causes, and the command that tells you which one you have.
23 articles tagged #troubleshooting, newest first.
EC2 MTU: 1500 vs 9001, and Why Jumbo Frames Break at the VPC Edge
EC2 instances default to a 9001-byte MTU inside the VPC and 1500 bytes to the internet. Where the boundary sits, and why transfers hang while pings succeed.
AWS `AccessDenied vs AccessDeniedException`: What It Means and How to Fix It
AccessDenied and AccessDeniedException are two IAM denial formats from two generations of AWS API. What each one tells you, and how to fix both.
AWS `AddressLimitExceeded`: What It Means and How to Fix It
AddressLimitExceeded is the Elastic IP quota — five per region by default, and usually full of addresses nothing is using. Causes, fixes and checks.
AWS `CannotPullContainerError`: What It Means and How to Fix It
CannotPullContainerError is an ECS task that cannot fetch its image — networking about half the time, IAM the other half. Ranked causes and fixes.
AWS `Client.InternalError`: What It Means and How to Fix It
Client.InternalError kills an EC2 instance right after launch, nearly always because of a KMS key it cannot use. The ranked causes and their fixes.
AWS `ExpiredToken`: What It Means and How to Fix It
ExpiredToken from AWS STS means your temporary credentials passed their expiry time. Why sessions end early, how to refresh, and how to prevent it.
AWS `failed to assign an IP address to container`: What It Means and How to Fix It
failed to assign an IP address to container is the VPC CNI out of addresses: a full subnet, or a node at its ENI limit. Ranked causes and fixes.
AWS `0/N nodes are available: Insufficient cpu`: What It Means and How to Fix It
0/N nodes are available: Insufficient cpu is the scheduler saying no node has room — measured against requests, not usage. Causes and their fixes.
AWS `InsufficientInstanceCapacity`: What It Means and How to Fix It
InsufficientInstanceCapacity is AWS running out of physical capacity in that availability zone — not a quota. What to change to get an instance now.
AWS `InvalidClientTokenId`: What It Means and How to Fix It
InvalidClientTokenId means AWS does not recognise the access key at all — deleted, deactivated, or from the wrong partition. Causes, fixes and checks.
AWS `Task timed out after N seconds`: What It Means and How to Fix It
Task timed out after N seconds is a Lambda killed at its configured timeout, often waiting on a call that can never complete. Causes and their fixes.
AWS `Lambda in a VPC cannot reach the internet`: What It Means and How to Fix It
Attaching a Lambda function to a VPC removes its internet access — the most predictable Lambda failure there is. Why it happens, and the two fixes.
AWS `FATAL: remaining connection slots are reserved`: What It Means and How to Fix It
FATAL: remaining connection slots are reserved is a PostgreSQL RDS instance at its connection ceiling — usually pooling, not load. Causes and fixes.
AWS `RequestTimeTooSkewed`: What It Means and How to Fix It
RequestTimeTooSkewed is a clock problem wearing the costume of a credentials problem. Why AWS rejects a skewed request, and how to fix the drift.
AWS `ResourceInitializationError`: What It Means and How to Fix It
ResourceInitializationError is a Fargate task that cannot reach Secrets Manager, SSM or ECR before it starts. Ranked causes, fixes, and the checks.
AWS `Runtime.ImportModuleError`: What It Means and How to Fix It
Runtime.ImportModuleError is the Lambda runtime failing to load your handler — a packaging or path problem, not a code bug. Causes and their fixes.
AWS `SignatureDoesNotMatch`: What It Means and How to Fix It
SignatureDoesNotMatch is the SigV4 signature failing to verify — almost always a malformed secret key, not a wrong one. Ranked causes and fixes.
AWS `SlowDown`: What It Means and How to Fix It
SlowDown from S3 is throttling on a single prefix — a partitioning problem, not a bucket-wide limit. Ranked causes, fixes, and how to spread the load.
AWS `ThrottlingException / RequestLimitExceeded`: What It Means and How to Fix It
ThrottlingException and RequestLimitExceeded are the AWS API rate limiter, usually reacting to code that polls in a loop. Causes, fixes and backoff.
AWS `UnauthorizedOperation`: What It Means and How to Fix It
UnauthorizedOperation from the EC2 API means IAM evaluated your request and said no. The ranked causes, a fix for each, and how to prove which one.
AWS `VcpuLimitExceeded`: What It Means and How to Fix It
VcpuLimitExceeded is an EC2 account quota, not a capacity shortage — and this one you can raise. How to read the limit, and how to request more.
Ephemeral Ports and the Network ACL Rule Everyone Forgets
Security groups are stateful, network ACLs are not. A NACL allowing inbound 443 but not outbound 1024-65535 lets a connection start, then kills it.
The VPC DNS Limit: 1,024 Packets per Second per ENI
The VPC resolver caps every network interface at 1,024 DNS packets per second. It is not adjustable, has no CloudWatch metric, and looks like random SERVFAIL.