How do I resolve the "Action needed" status of my Route 53 Resolver endpoint?

Last updated: 2020-06-16

My Amazon Route 53 Resolver endpoint is in "Action needed" status. How can I resolve this?

Resolution

You noticed the "Action needed" status after trying to add or remove an endpoint IP address

Verify whether your AWS Identity and Access Management (IAM) user or role has the required permissions to add or remove endpoint IP addresses.

When adding an IP address to an inbound or outbound Resolver endpoint:

When removing an IP address from an inbound or outbound Resolver endpoint:

Be sure that the IAM user or role has the following permissions to add or remove IP addresses from Route 53 Resolver endpoints:

Review AWS CloudTrail logs for more details about the denied action. The following is an example of a CloudTrail event for the "AssociateResolverEndpointIpAddress" call when the IAM user or role is missing permissions.

"responseElements": {
        "resolverEndpoint": {
            "id": "rslvr-in-aaaaaaaaaaaaaaaaa",
            "creatorRequestId": "AWSConsole.82.1579676363636",
            "arn": "arn:aws:route53resolver:us-east-1:111111111111:resolver-endpoint/rslvr-in-11111111111111111",
            "name": "aaa",
            "securityGroupIds": [
                "sg-11111111111111111"
            ],
            "direction": "INBOUND",
            "ipAddressCount": 4,
            "hostVPCId": "vpc-11111111",
            "status": "ACTION_NEEDED",
            "statusMessage": "1 IP address(es) failed to be created. Please remove them from the ResolverEndpoint.",
            "creationTime": "2020-01-22T06:59:25.990Z",
            "modificationTime": "2020-01-22T06:59:25.990Z"
        }
    }

You can also review CloudTrail logs for other events before or after the "AssociateResolverEndpointIpAddress" event to verify the missing IAM permission. For example, if the IAM user or role is missing the "CreateNetworkInterface" permission, the CloudTrail event for "CreateNetworkInterface" is as follows:

"eventSource": "ec2.amazonaws.com",
"eventName": "CreateNetworkInterface",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"errorCode": "Client.UnauthorizedOperation",
"errorMessage": "You are not authorized to perform this operation."

You noticed the "Action needed" status but you haven't tried to add or remove an endpoint IP address or you have the right IAM permissions

This means that the endpoint is unhealthy and Resolver can't automatically recover it. Common causes for this issue include:

  • Deletion of one or more of the network interfaces associated with the endpoint.
  • Inability to create the network interface.

To resolve the problem, check each IP address that you associated with the endpoint. For each unavailable IP address, add another IP address. Then, delete the unavailable IP address.

Note: An endpoint must always include at least two IP addresses.


Did this article help you?

Anything we could improve?


Need more help?