highFoundationSymptom-first#ec2#public-ip#eip#subnet

New instance has no public IP address

aws ec2 describe-instances shows no PublicIpAddress for a fresh instance

Likely source:configurationconnectivity

Focused incident mode — strips away everything but this runbook.

Symptoms

  • aws ec2 describe-instances shows no PublicIpAddress for a fresh instance
  • DNS records pointing at the old IP stale after replacement
  • SSH/public access fails on newly launched instances but works on older ones

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Instance IP fields

    aws ec2 describe-instances --instance-ids <INSTANCE-ID> --query 'Reservations[0].Instances[0].{PublicIp:PublicIpAddress,Subnet:SubnetId,Nic:NetworkInterfaces[0].NetworkInterfaceId}'

  • Subnet auto-assign setting

    aws ec2 describe-subnets --subnet-ids <SUBNET-ID> --query 'Subnets[0].MapPublicIpOnLaunch'

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • MapPublicIpOnLaunch is false on the subnet
  • Instance launched without an explicit associate-public-ip flag
  • No EIP was attached

Confirm before fixing

aws ec2 describe-subnets --subnet-ids <SUBNET-ID> --query 'Subnets[0].MapPublicIpOnLaunch'
READ

Confirm the subnet setting

Expected: false

Fix

aws ec2 allocate-address --domain vpc
CHANGE

Allocate an EIP and associate it with the instance (also patch the launch template for future runs)

Expected: AllocationId: eipalloc-...

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
aws ec2 describe-subnets --subnet-ids <SUBNET-ID> --query 'Subnets[0].MapPublicIpOnLaunch'
READ

Confirm the subnet behavior

2
aws ec2 allocate-address --domain vpc
CHANGE

Allocate an Elastic IP

3
aws ec2 associate-address --instance-id <INSTANCE-ID> --allocation-id <ALLOCATION-ID>
CHANGE

Associate it with the instance

Expected: AssociationId: eipassoc-...

4
aws ec2 authorize-security-group-ingress --group-id <SECURITY-GROUP-ID> --protocol tcp --port 22 --cidr <YOUR-CIDR>
CHANGE

Ensure the SG allows your SSH source before testing

Prevention

  • Enable Auto-assign public IPv4 address on public subnets, or pin EIPs in the launch template.
  • Reuse stable EIPs + DNS (Route53) instead of relying on launch-time public IPs.
  • Validate in CI: assert PublicIpAddress is present for every new-public deployment.

Related runbooks

Same stack, same failure family — worth a skim.

Public subnet instances have no internet accesscritical

ping/curl to the internet fails from an instance in a public subnet

AWSIntermediate3 causes
Open runbook
EC2 instance unreachable — status checks failingcritical

SSH to the instance times out or connection refused

AWSIntermediate3 causes
Open runbook
Subnet exhausted — no more IP addresses to launchhigh

run-instances fails: There aren't enough IP addresses available in subnet

AWSProductionUSE3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.