Skip to main content
selectAWSlast verified 2026-07-29
Servicesec2
CredentialsAWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
Permissionsec2:DescribeInstanceStatus
Fan-out: region - one call per region when swept across regions. One describe call per region when swept account-wide

EC2 instance state and lifecycle control

Reports the current state of every instance in a region alongside its two health checks. The instance check covers the guest (reachability, OS-level failure); the system check covers the underlying host and network. Use this to confirm a lifecycle operation completed, or to find instances that are running but impaired.

Query

SELECT
instance_id,
json_extract(instance_state, '$.name') as state_name,
json_extract(instance_status, '$.status') as instance_check,
json_extract(system_status, '$.status') as system_check,
availability_zone,
events
FROM aws.ec2.instance_status
WHERE region = '{{region}}'
AND IncludeAllInstances = true;

Stopping an instance

Stopping is a lifecycle operation (EXEC), not a configuration change. It returns as soon as the instance enters the stopping state, so poll the query above until state_name is stopped:

EXEC aws.ec2.instances.stop_instances
@InstanceId='i-0abcd1234ef567890',
@region='{{region}}';

Starting an instance

EXEC aws.ec2.instances.start_instances
@InstanceId='i-0abcd1234ef567890',
@region='{{region}}';

Notes

IncludeAllInstances = true is load-bearing: without it DescribeInstanceStatus returns only running instances, so stopped instances vanish from the result and an incomplete inventory looks like a complete one. instance_state, instance_status and system_status are all JSON objects - the state name is at $.name and each check result at $.status - and both checks read not-applicable while an instance is stopped rather than reporting a failure. Stop and start are asynchronous: they return on the state transition starting, not completing, so re-run the status query until the state settles. stop_instances also accepts optional @Hibernate, @Force, @SkipOsShutdown and @DryRun booleans, and start_instances accepts @AdditionalInfo and @DryRun. Stopping preserves EBS volumes and loses instance-store data; a stopped instance keeps its private IP but releases a non-elastic public IP, so the address changes on restart. To reboot in place use EXEC aws.ec2.instances.reboot_instances with the same arguments, and to terminate use DELETE FROM aws.ec2.instances WHERE region = '' AND InstanceId = '<instance_id>'.

Related queries

  • EC2 instances in a region - Lists EC2 instances in one region with type, state, addressing and network placement.
  • Launch an EC2 instance - Launches an EC2 instance through Cloud Control, returning a progress event to poll; user data must be base64 encoded.
  • Enabled AWS regions - Lists the AWS regions enabled for the account with endpoint, country and opt-in status; the valid fan-out list for region-swept queries.