Geek Answers Handbook

Instance startup: VPC security groups cannot be used to start without VPC

I am trying to create an instance in another region, but I am getting this error:

AWS Error Code: InvalidParameterCombination, AWS Error Message: VPC security groups may not be used for a non-VPC launch

Here is the code that I am executing.

 RunInstancesRequest instancereq = new RunInstancesRequest(); instancereq.setInstanceType("m3.medium"); instancereq.setImageId("ami-37b1b45e"); instancereq.setMinCount(1); instancereq.setMaxCount(1); ArrayList<String> secgroup = new ArrayList<String>(); instancereq.setKeyName("testkey"); secgroup.add("testdefault"); instancereq.setSecurityGroups(secgroup); instancereq.setPlacement(getAzPlacement()); RunInstancesResult instanceresult = ec2.runInstances(instancereq);

I also tried instead of using "testdefault" using the actual groupid (sg-########) , but I will get an error stating that the security group does not exist (which is wrong, it is). Which, based on the API document , if you are using non-default VPC, you should pass the actual groupid, but I will get an error similar to this

 InvalidGroup.NotFound, AWS Error Message: The security group 'sg-########' does not exist

If I use "default" as setSecurityGroups , it will use VPC by default. It just doesn't look like the group I'm going through, even though it is accurate.

Also, if I comment on the setSecurityGroups code and use setSubnetId and pass in the subnet ID, it will instantiate just fine, but it goes into the default security group and not “testdefault” as I want.

All I'm trying to do is create an instance and use its existing VPC group.

+6
source share
4 answers

My answer will give the following statement:

All I'm trying to do is create an instance and use its existing VPC group.

So, as I understand it, you want to start the instance in VPC not by default and assign it an existing VPC security group.

I am not a java guy, but I could do what you wanted in ruby , as shown below.

 require 'aws-sdk-core' Aws.config = { :access_key_id => "my_access_key", :secret_access_key => "my_secret_key", :region => 'us-west-2' } ec2 = Aws::EC2.new ec2.run_instances( min_count: 1, max_count: 1, image_id: 'ami-8635a9b6', instance_type: 't1.micro', placement: { availability_zone: 'us-west-2a' }, network_interfaces: [ { subnet_id: 'subnet-e881bd63', groups: ['sg-fd53bf5e'], device_index: 0, associate_public_ip_address: true } ], key_name: 'my-key' ).each do |resp| resp.instances.each do |x| puts x.instance_id end end

Although this is ruby code, it is pretty straight forward and should give you some clear tips on how to do this in java , since all of these AWS SDKs are polling the same web services APIs.

I think you should concentrate on the code above:

  :region => 'us-west-2'

and

 placement: { availability_zone: 'us-west-2a' }, network_interfaces: [ { subnet_id: 'subnet-e881bd63', groups: ['sg-fd53bf5e'], device_index: 0, associate_public_ip_address: true } ],
  • Make sure you explicitly specify the area.
  • Check how I determined the subnet identifier and the security group identifier. This code will launch my EC2 instance in subnet-e881bd63 my VPC and apply the VPC security group id sg-fd53bf5e to its 0 network interface. In addition, it will also assign a public IP address to my instance. (by default, it will not assign a public IP address when running instances in VPC).
  • FYI. When you run instances in VPC, you must specify the security group ID instead of the security group name.
+11
source

The same error occurs using the command line, so I am adding a separate answer that helps QuickNull. Just make sure you specify the security group and subnet. For instance:

 aws ec2 run-instances --image-id ami-XXXXXXXX --count 1 --instance-type t1.micro --key-name XXXXXXXX --security-group-ids sg-XXXXXXXX --subnet-id subnet-XXXXXXXX
+2
source

You cannot specify security group names to run VPC ( setSecurityGroups ). For non-default VPCs , you must use security group identifiers . See the EC2 run-instances page ( withSecurityGroupIds or --security-group-ids from the CLI).

When you specify a security group for a VPC with unchecked CLI checks or API actions, you must use the security group identifier and not the security group name to identify the security group.

See: Security Groups for EC2-VPC

on this topic:

+1
source

Thanks to @slayedbylucifer for its ruby code, here's the java solution for reference:

 // Creates an instance in the specified subnet of a non-default VPC and using the // security group with id sg-1234567 ec2.runInstances(new RuntInstancesRequest() ... .withSubnetId("subnet-1234abcd") .withSecurityGroupIds("sg-1234567"));
0
source

More articles:


All Articles