Home / AWS

AWSTroubleshootingBeginner

EC2 instance stuck in stopping, shutting-down or pending: force stop, state reasons and fixes

Get an EC2 instance out of stopping or shutting-down, read the state reason when a start bounces back to stopped, and fix the KMS, capacity and volume causes.

Deepak Bhardwaj7 min read

Applies toAmazon EC2 (Linux and Windows, EBS-backed instances), AWS CLI v2

Symptoms

  • An instance has shown stopping for more than 10–15 minutes and the console's Stop button does nothing.
  • A terminate request leaves the instance in shutting-down for a long time.
  • You start a stopped instance, it shows pending for a few seconds, then goes back to stopped.
  • Automation (patch windows, scheduled stop/start, Auto Scaling lifecycle hooks) times out waiting for a state change.

Each state needs a different fix. Start by reading what EC2 reports.

1. Read the state and the state reason

aws ec2 describe-instances --instance-ids i-0abc123 \
  --query "Reservations[].Instances[].{state:State.Name,reason:StateReason.Code,msg:StateReason.Message,transition:StateTransitionReason}" \
  --output table

StateReason is the useful field. StateTransitionReason adds the time of the last user-initiated change. The StateReason.Code values you will see most often are listed in this table.

State reason code What happened Fix
Client.UserInitiatedShutdown Someone or something called stop/terminate Expected, check CloudTrail if it surprised you
Client.InstanceInitiatedShutdown The OS shut itself down (shutdown -h, Windows shutdown) Check the instance's shutdown behaviour and scripts
Client.InternalError Usually an encrypted EBS volume the caller or EC2 can't decrypt (KMS) Section 3
Client.VolumeLimitExceeded Volume or attachment limit reached Check EBS quotas and attachments per instance type
Client.InvalidSnapshot.NotFound A snapshot in the block device mapping no longer exists Fix the AMI or launch template
Server.InsufficientInstanceCapacity No capacity for this type in this AZ right now Section 4
Server.InternalError Problem on the AWS side Retry; if it repeats, open a support case
Server.SpotInstanceTermination Spot capacity reclaimed Expected for Spot; design for it

2. Stuck in stopping: force stop

A normal stop sends an ACPI shutdown to the OS and waits. A hung OS, a frozen shutdown script, or a problem on the underlying host can leave it in stopping.

First, capture what the OS was doing. This is useful for the root cause and costs nothing:

aws ec2 get-console-output --instance-id i-0abc123 --latest --output text | tail -50
aws ec2 get-console-screenshot --instance-id i-0abc123 --query ImageData --output text | base64 -d > stuck.jpg

Then force the stop:

aws ec2 stop-instances --instance-ids i-0abc123 --force
aws ec2 wait instance-stopped --instance-ids i-0abc123

In the console, Force stop instance is offered only while the instance is in stopping. The CLI also accepts --force from pending or running.

Warning

A force stop does not flush file system caches. Writes still in memory are lost, and databases may need crash recovery on the next start. After a forced stop, run a file system check (fsck on Linux, chkdsk on Windows) and verify application data before you put the instance back in service.

Recent CLI versions also have --skip-os-shutdown, which skips the graceful OS shutdown entirely. Use it only when you already know the OS is hung and the data on the instance can be rebuilt. Check aws ec2 stop-instances help to confirm your CLI version has it.

If a force stop still leaves the instance in stopping after about 30 minutes, the problem is almost certainly on the host. Open a support case with the instance ID and the time of the force stop. You are not billed for instance usage while it is stuck in stopping.

Why it hung

Look at the console output you saved:

  • Linux: a systemd unit with a long TimeoutStopSec, an NFS or EFS mount that won't unmount because the network is already down, or a kernel panic.
  • Windows: Windows Update running "Working on updates, don't turn off your computer", or a service that ignores the stop request.
  • Hibernation: an instance stopped with --hibernate writes RAM to the root volume, which can take a while for large memory sizes. Check whether hibernation was used before you force anything.

3. Start bounces back to stopped: KMS and EBS

The most common cause is Client.InternalError on an instance with encrypted volumes. EC2 can't create a grant on the KMS key, so it can't attach the volume.

Find the keys on the instance's volumes:

aws ec2 describe-volumes --filters Name=attachment.instance-id,Values=i-0abc123 \
  --query "Volumes[].{id:VolumeId,enc:Encrypted,key:KmsKeyId}" --output table

aws kms describe-key --key-id <key-arn> \
  --query "KeyMetadata.{state:KeyState,manager:KeyManager}"
Finding Fix
KeyState is Disabled aws kms enable-key --key-id <key-arn>
KeyState is PendingDeletion aws kms cancel-key-deletion --key-id <key-arn>, then enable it
Key is in another account That account's key policy must allow your account (and the caller) kms:CreateGrant, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, kms:DescribeKey
Key is fine The IAM principal starting the instance lacks kms:CreateGrant on the key. Check CloudTrail for the denied KMS call

To find the denied call in CloudTrail:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=kms.amazonaws.com \
  --start-time 2026-10-27T08:00:00Z \
  --query "Events[?contains(CloudTrailEvent, 'AccessDenied')].[EventTime,EventName,Username]" --output table

The KMS post in this series covers key policies and grants in detail.

4. Start fails on capacity

A stopped instance gives up its host. On the next start, EC2 must find capacity for that instance type in the same Availability Zone. That can fail when the type is in short supply.

aws ec2 start-instances --instance-ids i-0abc123
# An error occurred (InsufficientInstanceCapacity) ...

Options, fastest first:

  1. Wait a few minutes and retry. Capacity frees up continuously.

  2. Change to a similar instance type in the same family or generation, then start:

    aws ec2 modify-instance-attribute --instance-id i-0abc123 --instance-type "{\"Value\": \"m6i.xlarge\"}"
aws ec2 start-instances --instance-ids i-0abc123

  3. For critical instances, buy an On-Demand Capacity Reservation in that AZ so the capacity is held for you.

You can't move a stopped instance to another AZ. To move it, create an AMI and launch the copy in a different subnet.

5. Stuck in shutting-down

Termination normally finishes in a few minutes. If it doesn't:

aws ec2 terminate-instances --instance-ids i-0abc123
aws ec2 describe-instances --instance-ids i-0abc123 --query "Reservations[].Instances[].State.Name"

Repeating the terminate call is safe. If the instance stays in shutting-down for more than about an hour, open a support case. If the instance had DeleteOnTermination=false volumes, check that they become available afterwards so you can delete or reuse them.

Caution

Termination protection (DisableApiTermination) and stop protection (DisableApiStop) make the API call fail with an OperationNotPermitted error. They do not cause a stuck state. If a call is being rejected, check those attributes before you assume the instance is hung.

Prevent it next time

  • Keep shutdown hooks short. On Linux, set a reasonable TimeoutStopSec on custom systemd units and use _netdev or nofail on network mounts.
  • Schedule Windows Update reboots inside maintenance windows, not right before planned stops.
  • Before you disable or schedule deletion of a KMS key, check for EBS volumes that use it.
  • For instances that must restart reliably, such as licence servers or single-instance databases, use a Capacity Reservation or allow a list of acceptable instance types in your runbook.
  • Alarm on StatusCheckFailed, and in stop/start automation use aws ec2 wait with a timeout, then send an alert instead of retrying forever.

Related fixes