🚨 AWS Error: 'The subnet ID does not exist' (InvalidSubnetID.NotFound) — Cause, Fix, and Troubleshooting Guide

Overview

EC2 rejects any launch, ENI creation, or resource association that references a subnet ID it cannot find in the current account and region with InvalidSubnetID.NotFound. Subnets are regional and account-scoped, so an ID that is perfectly valid in one region or account simply does not exist from the perspective of a differently-configured client.

You will see it surface from the CLI, an SDK, or Terraform:

An error occurred (InvalidSubnetID.NotFound) when calling the CreateNetworkInterface operation: The subnet ID 'subnet-0abc123REDACTED' does not exist

It occurs when the subnet was deleted, when your client is pointed at the wrong region/account, or when a stale config or typo carries an ID that no longer resolves.

Symptoms

• RunInstances, CreateNetworkInterface, CreateDBSubnetGroup, or an ASG launch fails with InvalidSubnetID.NotFound.
• terraform apply/plan fails on a subnet-... that was destroyed or recreated.
• The ID resolves in the console (in another region) but not from your CLI.

aws ec2 create-network-interface --subnet-id subnet-0abc123REDACTED

An error occurred (InvalidSubnetID.NotFound) when calling the CreateNetworkInterface operation: The subnet ID 'subnet-0abc123REDACTED' does not exist

Common Root Causes

1. The subnet was deleted or recreated

A teardown removed it, or IaC recreated it with a new ID, leaving downstream references stale.

2. Wrong region

The subnet exists, but in a different region than your --region / AWS_REGION.

3. Wrong account

Your credentials resolve to a different account than the one that owns the subnet (common with assumed roles or shared VPCs).

4. Stale IaC state or a hardcoded ID

Terraform state, a launch template, an RDS subnet group, or a pipeline variable pins an old ID.

5. A typo or truncated ID

A copy/paste error or a shortened ID that doesn’t match any real subnet.

How to diagnose

Step 1: Confirm your account and region

aws sts get-caller-identity --query Account --output text
aws configure get region

Step 2: Check whether the subnet exists here

aws ec2 describe-subnets --subnet-ids subnet-0abc123REDACTED \
  --query 'Subnets[].[SubnetId,VpcId,AvailabilityZone]' --output text

An error confirms it’s absent in this account/region.

Step 3: List real subnets to find the intended one

aws ec2 describe-subnets \
  --query 'Subnets[].[SubnetId,VpcId,AvailabilityZone,CidrBlock,Tags[?Key==`Name`]|[0].Value]' \
  --output table

Fixes

Point the call at the correct region/account

aws ec2 create-network-interface --subnet-id subnet-0abc123REDACTED --region eu-west-1

For a cross-account subnet, assume the owning account’s role (or use the shared subnet ID that RAM shared with you).

Update stale references to the live subnet ID

Refresh Terraform state or the launch template so it points at the current subnet:

terraform refresh
terraform apply

Fix the typo

Re-copy the full subnet-... ID from describe-subnets output and retry.

What to watch out for

• Reference subnets by tag/attribute in IaC (e.g. a data source filtering on Name) instead of hardcoded IDs, so a recreate doesn’t strand dependents.
• A recreated subnet gets a new ID; RDS subnet groups, ASGs, and launch templates that referenced the old one all need updating together.
• With shared VPCs (RAM), confirm your account is a participant — the ID only resolves for accounts it was shared with.
• Always verify region and account first; most NotFound subnet errors are context mismatches, not deletions.

Related

• AWS Error: ‘security group does not exist in VPC’ (InvalidGroup.NotFound) — the sibling error for a missing security group.
• AWS Error: ‘not enough free addresses in subnet’ (ENI) — the subnet exists but is out of IPs.
• AWS Error: ‘DependencyViolation’ — why a subnet resists deletion (and gets recreated).