Diagnose an unreachable EC2 SSH host without logging in

When a user asks you not to SSH into a VM (e.g. it is busy) but a client like cmux cannot connect, you can narrow it down from outside: 1. Your public IP vs SG rules: curl -s https://checkip.amazonaws.com and aws ec2 describe-security-groups --query SecurityGroups[0].IpPermissions[].IpRanges[].CidrIp 2. Instance health: aws ec2 describe-instance-status --include-all-instances --query InstanceStatuses[0].[InstanceStatus.Status,SystemStatus.Status] 3. TCP reachability (macOS nc): nc -z -G 5 <ip> 22 4. Server banner without auth: (sleep 3) | nc -G 5 <ip> 22 | head -1 -> SSH-2.0-OpenSSH_x means sshd is alive 5. Effective client config: ssh -G <alias> | grep -iE ^(user|hostname|identityfile|requesttty|remotecommand|proxyjump) 6. Load: aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization (BSD date: date -u -v-3H) If all pass, the failure is client-specific or inside the VM (e.g. cmux rejecting group-writable dirs under ~/.local/state); get the client error text next.