Skip to main content

AWS101 - Failed to Authorize a Security Group Rule

Agent error code #AWS101 indicates that the call adding a rule to the security group failed for a reason the agent could not attribute to a more specific cause. This is the operation that grants a user access.

More specific causes report their own codes: rejected credentials report #AWS001, a missing permission reports #AWS002, a missing group reports #AWS050, a rejected value reports #AWS051 and a rate limit reports #AWS003. Seeing this code means none of those applied.

Common causes include:

  • The security group has reached its rule limit
  • The agent host could not reach the EC2 API for the duration of the call
  • The call was cut short by a timeout
  • AWS returned an error that does not match any of the specific causes above

Steps to Resolve

Check the Rule Count Against the Quota

  1. In the AWS console, open the security group and count its inbound rules
  2. Compare that against the rules-per-security-group quota for the account under Service Quotas
  3. If the group is full, remove stale rules or raise the quota

Reproduce the Call by Hand

From the agent host, with the values from the failed grant:

sudo -u knocknoc aws ec2 authorize-security-group-ingress \
  --group-id <group-id> --protocol tcp --port <port> \
  --cidr 192.0.2.1/32 --region <region>

The error this returns is the one the agent received.

Confirm Connectivity

The agent needs outbound HTTPS to ec2.<region>.amazonaws.com. If the host uses a proxy, confirm the agent's service environment carries the proxy variables.

Check the Agent Log

The full AWS response is written to the agent log and never to this message. Inspect the log entry recorded with the failed grant.

Back to top