EC2 Serial Console: Setup, CLI Commands, and Troubleshooting

ec2 serial console is an AWS feature providing out-of-band, text-based access to an EC2 instance’s serial port, enabling boot and network troubleshooting when SSH, RDP, or the system console are unreachable.

# Enable serial console access at the account level (required once per region)
aws ec2 enable-serial-console-access --region us-east-1

Use the serial console when your instance is unreachable via SSH or RDP to diagnose boot failures, kernel panics, or network issues. The following sections cover enabling, configuring with GRUB, and connecting via CLI or console.

ec2 serial console Syntax Reference

# Associate an SSH public key with an instance for serial console authentication
aws ec2-instance-connect send-serial-console-ssh-public-key 
    --instance-id i-1234567890abcdef0 
    --serial-port 0 
    --ssh-public-key file://my-key.pub

# Connect via SSH through the serial console (after key association)
ssh -o ProxyCommand='aws ec2-instance-connect open-serial-console-port --instance-id i-1234567890abcdef0 --serial-port 0 --local-port 8000' 
    ec2-user@localhost -p 8000

Tested on AWS CLI v2.9.0 and Python 3.9 with IAM permissions: ec2:EnableSerialConsoleAccess, ec2:SendSerialConsoleSSHPublicKey.

ec2 serial console Rapid Reference Cheat Sheet

Advanced Implementation & Parameters

IAM Policies for Granular Control

To restrict serial console access by instance or port, use IAM condition keys. Below is a policy that allows sending a public key only to serial port 0 on a specific instance.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "ec2-instance-connect:SendSerialConsoleSSHPublicKey",
    "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-0abcdef",
    "Condition": {
      "NumericEquals": {"ec2:SerialConsolePort": "0"}
    }
  }]
}

GRUB Configuration for Serial Console Access

For the serial console to display boot messages and allow GRUB interaction, the kernel must be booted with serial console parameters. Modify /etc/default/grub and regenerate the configuration.

# On the impaired instance or its root volume mounted on a rescue instance:
GRUB_CMDLINE_LINUX_DEFAULT="console=tty0 console=ttyS0,115200n8"
GRUB_TERMINAL="console serial"
GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"

# Update GRUB (Ubuntu/Debian)
update-grub

# Update GRUB (RHEL/CentOS)
grub2-mkconfig -o /boot/grub2/grub.cfg

The parameters above enable both physical (tty0) and serial (ttyS0) consoles. Without this, the serial console may show a black screen after instance boot.

Using a Rescue Instance to Modify the Root Volume

When an instance is unreachable, you can attach its root volume to a healthy rescue instance in the same Availability Zone.

# Stop the impaired instance, detach root volume, attach to rescue instance
aws ec2 stop-instances --instance-ids i-xxxxxxxx
aws ec2 detach-volume --volume-id vol-xxxxxxxx
aws ec2 attach-volume --volume-id vol-xxxxxxxx --instance-id i-rescue --device /dev/xvdf

# Mount the volume and make GRUB/IAM changes
sudo mkdir /mnt/rescue
sudo mount /dev/xvdf1 /mnt/rescue
sudo chroot /mnt/rescue
# ... edit /etc/default/grub, run update-grub
exit
sudo umount /mnt/rescue
aws ec2 detach-volume --volume-id vol-xxxxxxxx
aws ec2 attach-volume --volume-id vol-xxxxxxxx --instance-id i-impaired --device /dev/xvda
aws ec2 start-instances --instance-ids i-impaired

Error Resolution & Troubleshooting

Production-Grade Implementation

• Enable only when needed: Use AWS Config rules to detect if serial console access is enabled at the account level and enforce a policy to disable it by default, enabling only for troubleshooting via a change request.
• Least-privilege IAM: Restrict ec2:SendSerialConsoleSSHPublicKey to specific instances and ports using condition keys. Never allow * on serial console actions in production accounts.
• Automated remediation: Use AWS Systems Manager Automation documents to attach a root volume, modify GRUB, and reboot the impaired instance, reducing manual rescue time.
• Audit serial console use: Enable AWS CloudTrail to log all SendSerialConsoleSSHPublicKey and OpenSerialConsolePort events. Set up alerts for anomalous use.
• Use dedicated SSH keys: Generate short-lived SSH keys for serial console sessions and never reuse production SSH keys.
• Test GRUB changes in a staging environment before applying to production instances, especially when using automated rescue workflows.

EC2 Serial Console is a lifeline for unreachable instances; configure it proactively with tight IAM controls and regular validation of GRUB settings to avoid black-screen scenarios during critical outages.

aws ec2 --region us-east-1 enable-serial-console-access

aws ec2 get-serial-console-access-status --region us-east-1

aws iam attach-user-policy --user-name MyUser --policy-arn arn:aws:iam::aws:policy/AmazonEC2SerialConsoleAccess

sudo systemctl status serial-getty@ttyS0.service

aws ec2 get-serial-console-screenshot --instance-id i-1234567890abcdef0 --output text

ssh -o "IdentitiesOnly=yes" -i /path/private_key ec2-user@serial-console-ec2