SerialConsoleAccessNotEnabled aws auth_error ai_generated true

An error occurred (SerialConsoleAccessNotEnabled) when calling the SendSerialConsoleSSHPublicKey operation: Serial console access is not enabled for the account or is not supported for the instance type

ID: aws/ec2-instance-connect-ip-not-authorized

Also available as: JSON · Markdown · 中文
85%Fix Rate
86%Confidence
1Evidence
2024-02-28First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
EC2 API 2016-11-15 active — — —
AWS CLI 2.14.0 active — — —

Root Cause

EC2 Serial Console access is not enabled at the account level, or the instance type does not support serial console connections (e.g., bare metal or older instances).

generic

中文

EC2 串行控制台访问未在账户级别启用，或者实例类型不支持串行控制台连接（例如裸金属或较旧的实例）。

Official Documentation

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-serial-console.html

Workarounds

  1. 90% success Enable EC2 Serial Console for the account in the AWS Region: 'aws ec2 enable-serial-console-access --region us-east-1' (requires ec2:EnableSerialConsoleAccess permission). Then retry the connection. 
    Enable EC2 Serial Console for the account in the AWS Region: 'aws ec2 enable-serial-console-access --region us-east-1' (requires ec2:EnableSerialConsoleAccess permission). Then retry the connection.
  2. 80% success If the instance type is unsupported, launch a new EC2 instance with a supported type (e.g., t3, m5, c5 families) that supports serial console. Check the AWS documentation for the full list. 
    If the instance type is unsupported, launch a new EC2 instance with a supported type (e.g., t3, m5, c5 families) that supports serial console. Check the AWS documentation for the full list.

中文步骤

  1. 在 AWS 区域中为账户启用 EC2 串行控制台：'aws ec2 enable-serial-console-access --region us-east-1'（需要 ec2:EnableSerialConsoleAccess 权限）。然后重试连接。
  2. 如果实例类型不受支持，启动一个支持串行控制台的新 EC2 实例（例如 t3、m5、c5 系列）。查看 AWS 文档获取完整列表。

Dead Ends

Common approaches that don't work:

  1. 85% fail

    Enabling serial console access via IAM policies alone doesn't work; the account-level feature must be explicitly enabled using the EC2 console or CLI.

  2. 95% fail

    Trying to use serial console on unsupported instance types (e.g., t2.micro, m5.metal) will always fail, even with account-level enablement.