Articles by Deepak Prasad
Fix "Not Authorized to Perform iam:PassRole" in AWS
Fix AWS AccessDenied for not authorized to perform iam PassRole when creating Lambda, ECS, or other resources that need an execution role. Identify the caller, add PassRole to the caller policy, restrict by role ARN and …
AWS IAM Explicit Deny vs Implicit Deny
How AWS IAM explicit deny and implicit deny differ, what AccessDenied messages can reveal, and how to inspect identity-policy evaluation with simulate-principal-policy.
Fix AWS STS AssumeRole AccessDenied
When sts:AssumeRole returns AccessDenied, check caller identity policy and the role trust policy together, read the CLI error, fix ExternalId or principal mismatches, and verify with get-caller-identity after a …
Configure and Switch Between Multiple AWS CLI Profiles
Configure multiple AWS CLI named profiles for dev and prod accounts, switch with --profile or AWS_PROFILE, verify the active account with aws sts get-caller-identity, and avoid profile and credential precedence mistakes …
How to Check Which Credentials AWS CLI Is Using
Check which credentials AWS CLI is using with aws configure list for credential source, sts get-caller-identity for the active account or role, environment and profile checks, and redacted debug provider lines on Linux …
Fix AWS InvalidAccessKeyId: Access Key ID Does Not Exist
When AWS returns InvalidAccessKeyId or “The AWS Access Key Id you provided does not exist in our records,” use aws configure list and IAM list-access-keys to find stale credentials and rotate safely.
Fix AWS CLI ExpiredToken
When AWS CLI returns ExpiredToken, temporary STS credentials passed their expiration — use aws configure list to find the source, refresh SSO, AssumeRole, or exported AWS_SESSION_TOKEN values, then confirm with sts …
AWS CLI "SSL certificate verify failed"? Fix It
Fix AWS CLI SSL certificate verify failed by reading the TLS error, inspecting the certificate chain with openssl s_client, building a CA bundle with your corporate root, and configuring --ca-bundle, AWS_CA_BUNDLE, or …
AWS CLI Unable to Locate Credentials? How to Fix It
Fix AWS CLI Unable to locate credentials by reading aws configure list, checking AWS_PROFILE and AWS environment variables, shared credential files, aws login, IAM Identity Center, and EC2 instance profile credentials on …
Fix AWS CLI InvalidClientTokenId
When AWS CLI returns InvalidClientTokenId, credentials are present but rejected — use aws configure list, env checks, key status, and sts get-caller-identity to find the stale or incomplete source and fix it.
AWS CLI "Could not connect to the endpoint URL"? Fix It
Fix AWS CLI Could not connect to the endpoint URL by reading the hostname in the error, confirming Region and service name, testing DNS and TCP/TLS to the Regional endpoint, checking proxy environment variables, and …
How to Shrink an AWS EBS Volume Safely
Why AWS cannot decrease EBS volume size in place, how to snapshot the source, size a smaller target, match encryption, migrate with rsync -aHAXx and a final quiesced sync, mount through fstab by UUID, verify with dry-run …
Move an EBS Volume to Another EC2 Instance
How to move an EBS data volume from one EC2 instance to another in the same Availability Zone with umount, detach-volume, and attach-volume, identify the Nitro NVMe device without mkfs, persist the mount in etc fstab, …
EBS Attached but /dev/sdf Missing on EC2? Find the NVMe Device
When the EC2 console shows an EBS volume attached at /dev/sdf but that path is missing inside Linux on Nitro, how to confirm the AWS attachment, map the volume ID to the real NVMe device with lsblk SERIAL and nvme …
Attach Existing EBS Volume to EC2 Without Losing Data
How to attach an existing EBS volume to EC2 in ap-south-1 without running mkfs, identify XFS or ext4 with lsblk, blkid, file -s, and wipefs -n, unmount and detach from the old host first, mount safely, handle duplicate …
Why /dev/sdf Appears as /dev/nvme1n1 on EC2
Learn why /dev/sdf appears as an NVMe device on Nitro EC2, how to map EBS volume IDs with lsblk, and why /etc/fstab should use UUIDs.
growpart Says NOCHANGE on EC2? How to Fix It
Why growpart returns NOCHANGE partition cannot be grown on EC2 after an EBS resize, how to compare EBS volume size with disk and partition size in lsblk, confirm the correct NVMe device and partition number, and extend …
xfs_growfs "data size unchanged, skipping"? Fix It on EBS
Why xfs_growfs prints data size unchanged, skipping after an EBS resize on EC2, how to compare EBS disk size with partition and XFS filesystem size using lsblk and df -hT, extend the partition with growpart, run …
Fix resize2fs: Bad Magic Number in Super-Block on AWS EBS
Why resize2fs reports bad magic number in super-block after an EBS resize on EC2, how to tell XFS from ext4 with df and lsblk, use xfs_growfs or resize2fs on the correct device, handle LVM layouts, and verify capacity on …
EBS Resized but df Still Shows Old Size? Fix It on EC2
Why an enlarged EBS volume can leave df unchanged on EC2, how to compare EBS block size with partition and filesystem size using lsblk and df -hT, extend the partition with growpart, grow ext4 with resize2fs or XFS with …
SSH to a Private EC2 Instance Without a Public IP or Bastion
How to SSH to a private EC2 instance without a public IPv4 or bastion using EC2 Instance Connect Endpoint, including security groups, IAM permissions, the aws ec2-instance-connect ssh command, troubleshooting, and …
EC2 Metadata 401 Unauthorized? Fix IMDSv2 with curl
Why curl to 169.254.169.254 returns HTTP 401 when EC2 requires IMDSv2 tokens, the immediate PUT token and metadata GET fix, how to check HttpTokens in the console and CLI, token TTL and hop limits, common curl mistakes, …
EC2 SSH Connection Timed Out? How to Fix It
Why EC2 SSH connection times out on Linux when status checks pass, how to verify public IPv4 and TCP port 22, security group source CIDR, public subnet route to an internet gateway, NACL return path, and Reachability …
Recover an Unbootable EC2 Linux Instance with a Rescue Instance
How to recover an unbootable EC2 Linux instance by stopping it, detaching the root EBS volume, attaching it to a rescue instance in the same Availability Zone, mounting and repairing the filesystem offline, and restoring …
Recover an EC2 Linux Instance Stuck in Emergency Mode
How to recognize EC2 Linux emergency mode from status checks and system log output, choose Serial Console, AWSSupport-ExecuteEC2Rescue, or a manual rescue instance, stop and snapshot the root volume, fix fstab offline, …
How to Run EC2 User Data on Every Reboot
How to run EC2 user data on every reboot with cloud-init per-boot scripts, scripts-user always, systemd, or bootcmd, prove default shell user data runs once, and verify behavior across multiple reboots on RHEL 10.
IAM AccessDenied Despite AdministratorAccess
Why AWS returns AccessDenied when AdministratorAccess is attached, how to read the error message, which restricting policy to check first, and how to fix an explicit or implicit deny without attaching another admin …
CloudWatch Agent Not Sending Logs from EC2
Why the CloudWatch agent on EC2 can run without delivering log events, how to read agent status and logs, verify file path and trailing newlines, IAM and Region, test Logs API connectivity, apply fetch-config, and …
EC2 Instance Connect Not Working? How to Fix It
Why EC2 Instance Connect browser or CLI connections fail when send-ssh-public-key returns AccessDenied, Success without SSH login, connection timed out, or connection refused, how instance metadata and sshd …
EC2 Disk Full and SSH No Longer Works
Why a full EC2 root filesystem stops SSH and service writes, how to tell block exhaustion from inode exhaustion with df, recover through Session Manager or serial console without SSH, free space, resize EBS, find large …