SAM Doctor

ERROR REFERENCE

EC2 could not create a network interface

A provider or deployment wrapper reported a failed CreateNetworkInterface call. The wrapper is not the cause by itself; read the nested EC2 status and error code before changing IAM or widening a subnet.

WHAT IT MEANS

The nested EC2 error is the useful signal

Error: creating EC2 Network Interface: operation error EC2: CreateNetworkInterface, https response error StatusCode: 400, RequestID: request-id, api error InvalidParameterValue: There aren't sufficient free IPv4 addresses in the subnet

The outer line only identifies the operation that failed. The nested HTTP status, request ID, and ErrorCode distinguish subnet address exhaustion, security-group limits, missing permissions, invalid IP or tag parameters, and endpoints or emulators that do not implement the EC2 operation.

NEXT CHECK

Follow the error code, not the wrapper

  1. Keep the complete evidence. Record the nested HTTP status, request ID, error code, Region, subnet, security groups, and any IP or tag parameters before retrying.
  2. Check subnet capacity when named. Run aws ec2 describe-subnets --subnet-ids <subnet-id> --region <region> and review AvailableIpAddressCount. A busy or fragmented subnet may need a larger or separate subnet.
  3. Separate permissions from request shape. For UnauthorizedOperation or AccessDenied, verify the least-privilege ec2:CreateNetworkInterface grant. For InvalidParameterValue, correct the request or quota named by the nested message instead of adding IAM.
  4. Check custom endpoints separately. If a local emulator or proxy handled the call, confirm that it implements CreateNetworkInterface before changing the template.

AUTOMATE THE TRIAGE

Keep the check in your normal workflow

SAM Doctor recognizes the provider wrapper with low confidence and keeps the handoff focused on the nested EC2 cause. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED