What’s your troubleshooting order when an EC2 instance suddenly stops accepting SSH?

You don’t need SSH access to review or change the security group, NACL, route table, or instance networking settings; those are managed through the cloud control plane. If the AWS-side checks look normal, use the recovery console or another out-of-band access method where available, and consider a reboot or instance recovery only after checking the likely cause.

A practical sequence is: instance status, network reachability, security group and NACL rules, route table, expected public or private IP, and finally the OS-level SSH daemon. A TCP traceroute or another port-specific connectivity test can help identify whether the connection is failing before it reaches the instance.

Start by confirming the instance is actually healthy: check its running state and both instance and system status checks. Then verify the network path, including the destination IP, whether it’s public or private, the route table, and any intervening connectivity such as a VPN or bastion host. After that, inspect the security group and network ACL, then check whether the operating system’s SSH service and local firewall are still working.