How to fix Error: Error creating Security Group: LimitExceeded in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 89 views

Your AWS account has hit the limit for security groups in a VPC or region. This happens when creating too many security groups or when Terraform state becomes out of sync with AWS. You can request a limit increase, consolidate security groups, or clean up unused resources.

Quick fix

Fixes LimitExceeded

# List all security groups and count them
aws ec2 describe-security-groups --query 'SecurityGroups[*].[GroupId,GroupName]' --output text | wc -l

# Get detailed quota information
aws service-quotas get-service-quota \
  --service-code vpc \
  --quota-code L-E79EC296 \
  --region us-east-1
  1. Check current security group usage in AWS
  2. Clean up unused security groups (if possible)
  3. Request a limit increase through AWS Service Quotas
  4. Consolidate security groups in Terraform
terraform — error
# List all security groups and count them
aws ec2 describe-security-groups --query 'SecurityGroups[*].[GroupId,GroupName]' --output text | wc -l
# Get detailed quota information
aws service-quotas get-service-quota \
  --service-code vpc \
  --quota-code L-E79EC296 \
  --region us-east-1
Error: Error creating Security Group: LimitExceeded

What this error means

AWS enforces quotas (limits) on the number of resources you can create. For security groups, the default limits are: - 500 security groups per VPC - 2,500 security groups per region - 60 inbound rules + 60 outbound rules per security group When Terraform tries to create a new security group and you've hit one of these limits, AWS returns the "LimitExceeded" error. This is a hard architectural limit to prevent runaway resource creation and ensure API performance. The error prevents the security group from being created until you either increase your quota or remove unused security groups.

Typical symptoms

  • terraform apply fails with 'Error creating Security Group: LimitExceeded'
  • Error occurs when adding new security groups to an existing VPC
  • Works in one AWS region but fails in another
  • Error message includes 'SecurityGroupsPerVpc' or 'InboundRulesPerSecurityGroup' quota name
  • terraform destroy and reapply still fails without quota increase

Common causes

  1. VPC has 500+ security groups (or region has 2,500+) - default limit reached
  2. Too many inbound/outbound rules in a single security group (>60 each)
  3. Terraform creating duplicate security groups due to state mismatch or naming conflicts
  4. CI/CD pipeline repeatedly applying infrastructure without cleanup
  5. Orphaned security groups from previous Terraform runs still consuming quota
  6. Multiple Terraform workspaces or projects deploying to the same VPC without coordination

How to fix "Error: Error creating Security Group: LimitExceeded"

1Check current security group usage in AWS

First, determine if you've actually hit the limit:

bash
# List all security groups and count them
aws ec2 describe-security-groups --query 'SecurityGroups[*].[GroupId,GroupName]' --output text | wc -l

# Get detailed quota information
aws service-quotas get-service-quota \
  --service-code vpc \
  --quota-code L-E79EC296 \
  --region us-east-1

If the count is close to 500 (per VPC) or 2,500 (per region), you've hit the limit.

2Clean up unused security groups (if possible)

Before requesting a quota increase, remove any orphaned security groups:

bash
# List security groups not attached to any resources
aws ec2 describe-security-groups --query \
  'SecurityGroups[?length(IpPermissions) == `0` && length(IpPermissionsEgress) <= `1`].[GroupId,GroupName]'

# Delete a specific unused security group (cannot delete if attached to instances)
aws ec2 delete-security-group --group-id sg-xxxxxxxxx

Note: You cannot delete the default security group for a VPC. Also, security groups attached to running instances cannot be deleted.

3Request a limit increase through AWS Service Quotas

If you need more security groups, request a quota increase:

1. Go to the AWS Console: Service Quotas → VPC
2. Search for "Security groups per VPC" (quota code L-E79EC296)
3. Click the quota name
4. Click "Request quota increase"
5. Enter the new desired count (e.g., 1000)
6. Click "Request quota increase"

AWS typically approves quota increases within minutes to hours. You'll receive an email when the quota is increased.

Alternatively, use the AWS CLI:

bash
aws service-quotas request-service-quota-increase \
  --service-code vpc \
  --quota-code L-E79EC296 \
  --desired-value 1000 \
  --region us-east-1
4Consolidate security groups in Terraform

Instead of creating a new security group, consolidate rules into existing ones:

hcl
# BEFORE: Creating a new security group for each rule set (inefficient)
resource "aws_security_group" "app_http" {
  vpc_id = aws_vpc.main.id
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "app_https" {
  vpc_id = aws_vpc.main.id
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# AFTER: Single security group with multiple rules
resource "aws_security_group" "app" {
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
5Verify Terraform state matches AWS reality

State drift can cause Terraform to try creating duplicates:

bash
# Import any manually created security groups
terraform import aws_security_group.existing sg-xxxxxxxxx

# Refresh state to sync with AWS
terraform refresh

# Validate the plan before applying
terraform plan

# If there are orphaned resources in state, remove them
terraform state rm aws_security_group.old_broken_sg

Review the plan output carefully. If you see unexpected resource creation attempts, there's likely state drift.

6Use AWS managed prefix lists to reduce rule count

If you have many similar rules, use AWS managed prefix lists instead:

hcl
# Define rules using a single prefix list instead of multiple CIDR blocks
resource "aws_security_group" "app" {
  vpc_id = aws_vpc.main.id

  # Instead of 20 separate rules for AWS service IPs, use one prefix list
  ingress {
    from_port           = 443
    to_port             = 443
    protocol            = "tcp"
    prefix_list_ids     = ["pl-12345678"]  # AWS managed prefix list for CloudFront
  }
}

AWS provides managed prefix lists for common services (CloudFront, S3, DynamoDB, etc.). This reduces rule count without limiting functionality.

Advanced notes

Multi-Region Considerations: Each AWS region has its own quota of 2,500 security groups. If you're deploying across regions, hitting the limit in one region doesn't affect others. However, if you're using a single VPC spanning regions (not typical), consolidate your approach.

Service-Specific Limits: Some AWS services like ECS, RDS, and EKS automatically create security groups. If using these services heavily, they can consume your quota quickly. Consider using service-linked security groups or having dedicated VPCs per environment.

Terraform State Considerations: If your Terraform state has orphaned security groups (created but not attached to instances), they still count against your quota. Regular terraform plan and cleanup prevents quota exhaustion.

Quota Increase Timing: Quota increase requests are usually approved within minutes. However, during extreme demand periods, approval might take hours. Plan infrastructure changes early if you anticipate needing quota increases.

Frequently asked questions

What does "LimitExceeded" mean?
AWS enforces quotas (limits) on the number of resources you can create. For security groups, the default limits are: - 500 security groups per VPC - 2,500 security groups per region - 60 inbound rules + 60 outbound rules per security group When Terraform tries to create a new security group and you've hit one of these limits, AWS returns the "LimitExceeded" error. This is a hard architectural limit to prevent runaway resource creation and ensure API performance.
How do I fix "LimitExceeded"?
Your AWS account has hit the limit for security groups in a VPC or region. This happens when creating too many security groups or when Terraform state becomes out of sync with AWS. You can request a limit increase, consolidate security groups, or clean up unused resources.
What causes "LimitExceeded"?
VPC has 500+ security groups (or region has 2,500+) - default limit reached Too many inbound/outbound rules in a single security group (>60 each) Terraform creating duplicate security groups due to state mismatch or naming conflicts
Is the "LimitExceeded" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading