Skip to main content

AWS100 - Failed to Describe Security Group Rules

Agent error code #AWS100 indicates that Knocknoc could not read the current rules on the security group. This read runs before any change is made to the group, so the grant stops here.

More specific causes report their own codes: rejected credentials report #AWS001, a missing permission reports #AWS002, a missing group reports #AWS050 and a rate limit reports #AWS003. Seeing this code means none of those applied.

Common causes include:

  • The agent host cannot reach the EC2 API endpoint
  • A proxy between the agent and AWS returned something other than the API response
  • The call was cut short by a timeout
  • AWS returned an error that does not match any of the specific causes above

Steps to Resolve

Confirm Connectivity to the EC2 API

From the agent host:

sudo -u knocknoc aws ec2 describe-security-groups --group-ids <group-id> --region <region>

A successful call prints the group. Any error here is the same one the agent is hitting.

Check Egress and Proxy Settings

  1. The agent needs outbound HTTPS to ec2.<region>.amazonaws.com
  2. If the host uses an HTTP proxy, confirm the agent's environment carries the proxy variables. The agent inherits the service manager's environment, not your shell's
  3. A proxy that returns an HTML error page produces output the CLI cannot parse

Check the Agent Log

The full CLI output is written to the agent log and never to this message. The log entry for the failed operation carries the underlying cause.

Why This Is Worth Fixing Promptly

While this read is failing, expired entries are not removed from the security group. Access that should have lapsed stays open until the read succeeds again, so treat a persistent failure here as urgent rather than cosmetic.

Back to top