Separate an AWS credential-read test from the permissions and resource availability needed to launch a customer instance. A successful connection check is useful, but it is not a complete provisioning test.

Identify the selected account and region

Open PD Modules → PD EC2 → Settings. The module-level test uses the first saved EC2 account and Default AWS region. It does not check every saved account or automatically follow the last product or package viewed.

The test uses DescribeRegions. It is read-only and does not create an instance, key pair or security group. If the result is a generic connection error, record that exact message and when it occurred; it does not identify the failed permission or network condition by itself.

Review credentials and access

1. Confirm that both saved key values belong to the intended IAM identity and AWS account. Check for a copied space or a key that was disabled or replaced.
2. If the secret is unknown, ask the AWS administrator to follow the normal replacement process. Do not delete a working key before reviewing other integrations that might use it.
3. Have the administrator verify the actual permission for the failed request and the module’s required lifecycle actions. A key that can describe regions can still be refused when launching, tagging or managing resources.
4. Confirm the intended AWS account and region are enabled for the service and have the relevant quotas. A connection check does not reserve instance capacity.
5. For reachability or signing failures, check outbound HTTPS and the billing-system server’s clock with your server administrator. Keep certificate verification enabled.

If an error names another AWS action during provisioning, inspect that action’s permission and resource scope. Do not infer that every refusal means the policy was trimmed; account restrictions and other policy layers can also affect access.

Check the actual launch region separately

The module’s catalogue and pricing use Default AWS region, while each offering chooses its own launch region. A listed instance type or image in the default-region catalogue is not proof that the requested combination works in a different region or Availability Zone. AWS documents instance-type availability by region.

Check a launch failure separately

If activation already ran, open the affected service in PD Modules → PD EC2 → Clients & Services and read Activity. Compare the recorded request, selected account and launch region with the instance and related resources you can see in your own AWS account. A failed launch does not establish that no preparatory key, security group, volume or address was created.

Record whether there is a running instance, an operation still in progress, or a displayed failure. If the module and AWS disagree, compare the recorded operation with the existing AWS resources. Do not submit another create request while that discrepancy remains unresolved. Use these observations to establish the earlier operation’s outcome before repeating it.

See the PD AWS EC2 Blesta guide for related setup, or explore PD AWS EC2.