Skip to main content

AWS102 - Failed to Revoke a Security Group Rule

Agent error code #AWS102 indicates that the call removing a rule from the security group failed. Access that should have been withdrawn may still be in place.

More specific causes report their own codes: rejected credentials report #AWS001, a missing permission reports #AWS002, a missing group reports #AWS050 and a rate limit reports #AWS003. Seeing this code means none of those applied.

Common causes include:

  • The rule was already removed by another tool, so the revoke had nothing to act on
  • The identity has permission to add rules but not to revoke them
  • The agent host could not reach the EC2 API for the duration of the call
  • The call was cut short by a timeout

Steps to Resolve

Confirm Whether the Rule Is Still There

  1. In the AWS console, open the security group and look for a rule allowing the address from the failed revoke
  2. Treat a rule that is still present as live access until it is gone

Remove the Rule by Hand if It Remains

sudo -u knocknoc aws ec2 revoke-security-group-ingress \
  --group-id <group-id> --region <region> \
  --ip-permissions 'IpProtocol=tcp,FromPort=<port>,ToPort=<port>,IpRanges=[{CidrIp=192.0.2.1/32}]'

For an IPv6 address, replace IpRanges=[{CidrIp=...}] with Ipv6Ranges=[{CidrIpv6=2001:db8::1/128}].

Confirm the Revoke Permission

An IAM policy that grants ec2:AuthorizeSecurityGroupIngress without ec2:RevokeSecurityGroupIngress produces exactly this pattern: grants succeed and revokes fail. Check the policy covers both.

Check It Clears on a Later Attempt

A failed revoke is retried automatically. If this code keeps appearing for the same address, remove the rule by hand rather than waiting.

Still Having Issues?

We can help you out, contact us at [email protected].