Skip to main content

AWS102 - Failed to Revoke a Security Group Rule

Agent error code #AWS102 indicates that the call removing a rule from the security group failed. Access that should have been withdrawn may still be in place.

More specific causes report their own codes: rejected credentials report #AWS001, a missing permission reports #AWS002, a missing group reports #AWS050 and a rate limit reports #AWS003. Seeing this code means none of those applied.

Common causes include:

  • The rule was already removed by another tool, so the revoke had nothing to act on
  • The identity has permission to add rules but not to revoke them
  • The agent host could not reach the EC2 API for the duration of the call
  • The call was cut short by a timeout

Steps to Resolve

Confirm Whether the Rule Is Still There

  1. In the AWS console, open the security group and look for a rule allowing the address from the failed revoke
  2. Treat a rule that is still present as live access until it is gone

Remove the Rule by Hand if It Remains

sudo -u knocknoc aws ec2 revoke-security-group-ingress \
  --group-id <group-id> --protocol tcp --port <port> \
  --cidr 192.0.2.1/32 --region <region>

Confirm the Revoke Permission

An IAM policy that grants ec2:AuthorizeSecurityGroupIngress without ec2:RevokeSecurityGroupIngress produces exactly this pattern: grants succeed and revokes fail. Check the policy covers both.

Check It Clears on a Later Attempt

A failed revoke is retried automatically. If this code keeps appearing for the same address, remove the rule by hand rather than waiting.

Back to top