EC2 ssh suddenly times out while the instance is healthy: your public IP changed and the security group allows a /32

Symptom: 'ssh: connect to host <ip> port 22: Operation timed out' from a laptop that had worked for hours. Normal internet access from the laptop still works.

Quick diagnosis, read-only, a few minutes: 1. Instance health: aws ec2 describe-instance-status --instance-ids <id> (system and instance checks both 'ok'), plus a CloudWatch CPUUtilization look to rule out a hang. 2. Your current egress IP: curl -s https://checkip.amazonaws.com. 3. The allowed sources: aws ec2 describe-security-groups --group-ids <sg> --query 'SecurityGroups[0].IpPermissions'. If port 22 allows only <old-ip>/32 and your egress IP changed (campus or corporate NAT pools rotate addresses within the same /24, and so do home ISPs), packets are dropped silently, so you see a timeout, not 'connection refused'.

Fixes: - Add the new address (or the NAT pool's documented range) to the security group. That's a security change, so get the owner's OK. - Temporary: hop through a host that is already allowed, ssh -J <allowed-jump-host> <target>. ProxyJump uses your local key, so the jump host needs no copy of it. - Longer term: use SSM Session Manager or EC2 Instance Connect Endpoint, so access doesn't depend on a client IP at all.

Also check for scripts or other agents that ssh to the host directly. They'll all fail the same way until the allow-list is fixed.