Why Can’t I Associate Elastic IP with EC2 Instance

amazon-elastic-ip

I have a running EC2-classic instance, at t2-micro. It has the public IP that was associated with it when it started. Despite having RTFM three times[1] I can't figure out how to associate an allocated elastic IP with the running instance.

I allocated a new address under "Elastic IPs". I right click and do "Associate Address". It gives me a "search instance id or tag" field, but it doesn't seem to be able to find the (running) instance by either one, whether I start typing the first few characters or if paste the whole thing in. If I do paste the whole id or name in and hit enter I get an error "An error occurred while attempting to associate the address / The request must contain the parameter instance id". Instance and Elastic IP are both in us-west1.

[1] http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

Best Answer

You can't allocated a VPC EIP with an EC2-classic instance. I suspect Elastic IPs are allocated in VPC by default.

I suggest you allocate a new EIP you look for options about where it's created and make sure it says "EC2 Classic". I don't have access to EC2-classic as my account is too new. Amazon has documentation on this topic here.

This page has some useful information:

After some playing around – for way longer than I wanted to spend – I deleted the elastic IP and recreated it. When first creating (“allocating”) an elastic IP it gives you two choices – EC2 or VPC. The default selected in the list is EC2 and that’s what I originally left as my selected choice. I changed this to VPC and voila! – now I could associate the IP to my running VM nice and easily.

Related Solutions

Limit EC2 Key to Just ec2-associate-address – How to Guide

This is indeed possible by means of AWS Identity and Access Management (IAM), which enables you to securely control access to AWS services and resources for your users (facilitating IAM instead of the main account credentials for everyday AWS usage is nowadays highly recommended accordingly).

Amongst several others, IAM enables the following use case:

Fine-grained access control to your AWS resources: IAM enables you to control access to AWS service APIs and to specific resources. IAM also enables you to add specific conditions to control how a user can use AWS, such as time of day, their originating IP address, or whether they are using SSL.

The respective granularity varies between the available AWS services (it tends to get increased over time), but fortunately granularity for the EC2 API is high and what you are looking for is readily available - for example, you might want to check out the recommended AWS Policy Generator, select type IAM Policy and service Amazon EC2, which will allow you to select action AssociateAddress in turn.

Consequently you should be able to achieve your goal by creating a dedicated IAM user for the task at hand, crafting an IAM policy essentially limited to AssociateAddress (maybe DisassociateAddress as well) and assigning this policy to the IAM user - e.g. the policy might look like this:

{
  "Statement": [
    {
      "Action": [
        "ec2:AssociateAddress",
        "ec2:DisassociateAddress"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Assign multiple Elastic IPs to EC2 instance

Classic EC2 instances can only have a single Elastic IP address associated with them. To get multiple IP addresses, you must use VPC and setup multiple network interfaces on your instance.

NOTE: sometime between 2012 and 2014 AWS changed so that a single ENI can have multiple EIPs assigned to it. This answer, and the question, are no longer relevant as a result.

Best Answer

Related Solutions

Limit EC2 Key to Just ec2-associate-address – How to Guide

Assign multiple Elastic IPs to EC2 instance

Related Topic