# Connection to EC2 instance timed out while using Instance Connect: Connection refused

- **ID:** `aws/ec2-instance-connect-connection-refused`
- **Domain:** aws
- **Category:** network_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The EC2 instance's SSH daemon (sshd) is not running, or the security group inbound rule does not allow SSH traffic (port 22) from AWS Instance Connect IP ranges, or the instance is in a subnet without internet access for the Instance Connect service.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| EC2 API 2016-11-15 | active | — | — |
| AWS CLI 2.17.0 | active | — | — |
| Amazon Linux 2023 | active | — | — |

## Workarounds

1. **Verify sshd is running on the instance by connecting via EC2 Serial Console or using AWS Systems Manager Session Manager: `aws ssm start-session --target instance-id`. Then run `systemctl status sshd` and start it if not running.** (85% success)
   ```
   Verify sshd is running on the instance by connecting via EC2 Serial Console or using AWS Systems Manager Session Manager: `aws ssm start-session --target instance-id`. Then run `systemctl status sshd` and start it if not running.
   ```
2. **Ensure the security group allows inbound SSH from AWS Instance Connect IP ranges. Check the current ranges at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html#ec2-instance-connect-inbound. Add a rule for port 22 from the source `35.180.0.0/16` (example for us-east-1).** (90% success)
   ```
   Ensure the security group allows inbound SSH from AWS Instance Connect IP ranges. Check the current ranges at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html#ec2-instance-connect-inbound. Add a rule for port 22 from the source `35.180.0.0/16` (example for us-east-1).
   ```

## Dead Ends

- **Restarting the EC2 instance from the AWS Console, assuming a complete reboot will fix the SSH daemon.** — If sshd is misconfigured or not enabled, a reboot does not change its state unless the init system is fixed. (70% fail)
- **Adding a security group rule allowing SSH from 0.0.0.0/0, thinking it's a general connectivity issue.** — While this may allow SSH, it is overly permissive and does not address the Instance Connect-specific IP ranges or sshd status. (60% fail)