How to fix Error: Error creating Security Group: LimitExceeded in Terraform

TerraformINTERMEDIATEHIGH

Your AWS account has hit the limit for security groups in a VPC or region. This happens when creating too many security groups or when Terraform state becomes out of sync with AWS. You can request a limit increase, consolidate security groups, or clean up unused resources.

What this error means

AWS enforces quotas (limits) on the number of resources you can create. For security groups, the default limits are: - 500 security groups per VPC - 2,500 security groups per region - 60 inbound rules + 60 outbound rules per security group When Terraform tries to create a new security group and you've hit one of these limits, AWS returns the "LimitExceeded" error. This is a hard architectural limit to prevent runaway resource creation and ensure API performance. The error prevents the security group from being created until you either increase your quota or remove unused security groups.

How to fix "Error: Error creating Security Group: LimitExceeded"

1Check current security group usage in AWS

First, determine if you've actually hit the limit:

bash

# List all security groups and count them
aws ec2 describe-security-groups --query 'SecurityGroups[*].[GroupId,GroupName]' --output text | wc -l

# Get detailed quota information
aws service-quotas get-service-quota \
  --service-code vpc \
  --quota-code L-E79EC296 \
  --region us-east-1

If the count is close to 500 (per VPC) or 2,500 (per region), you've hit the limit.

2Clean up unused security groups (if possible)

Before requesting a quota increase, remove any orphaned security groups:

bash

# List security groups not attached to any resources
aws ec2 describe-security-groups --query \
  'SecurityGroups[?length(IpPermissions) == `0` && length(IpPermissionsEgress) <= `1`].[GroupId,GroupName]'

# Delete a specific unused security group (cannot delete if attached to instances)
aws ec2 delete-security-group --group-id sg-xxxxxxxxx

Note: You cannot delete the default security group for a VPC. Also, security groups attached to running instances cannot be deleted.

3Request a limit increase through AWS Service Quotas

If you need more security groups, request a quota increase:

1. Go to the AWS Console: Service Quotas → VPC
2. Search for "Security groups per VPC" (quota code L-E79EC296)
3. Click the quota name
4. Click "Request quota increase"
5. Enter the new desired count (e.g., 1000)
6. Click "Request quota increase"

AWS typically approves quota increases within minutes to hours. You'll receive an email when the quota is increased.

Alternatively, use the AWS CLI:

bash

aws service-quotas request-service-quota-increase \
  --service-code vpc \
  --quota-code L-E79EC296 \
  --desired-value 1000 \
  --region us-east-1

4Consolidate security groups in Terraform

Instead of creating a new security group, consolidate rules into existing ones:

hcl

# BEFORE: Creating a new security group for each rule set (inefficient)
resource "aws_security_group" "app_http" {
  vpc_id = aws_vpc.main.id
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "app_https" {
  vpc_id = aws_vpc.main.id
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# AFTER: Single security group with multiple rules
resource "aws_security_group" "app" {
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

5Verify Terraform state matches AWS reality

State drift can cause Terraform to try creating duplicates:

bash

# Import any manually created security groups
terraform import aws_security_group.existing sg-xxxxxxxxx

# Refresh state to sync with AWS
terraform refresh

# Validate the plan before applying
terraform plan

# If there are orphaned resources in state, remove them
terraform state rm aws_security_group.old_broken_sg

Review the plan output carefully. If you see unexpected resource creation attempts, there's likely state drift.

6Use AWS managed prefix lists to reduce rule count

If you have many similar rules, use AWS managed prefix lists instead:

hcl

# Define rules using a single prefix list instead of multiple CIDR blocks
resource "aws_security_group" "app" {
  vpc_id = aws_vpc.main.id

  # Instead of 20 separate rules for AWS service IPs, use one prefix list
  ingress {
    from_port           = 443
    to_port             = 443
    protocol            = "tcp"
    prefix_list_ids     = ["pl-12345678"]  # AWS managed prefix list for CloudFront
  }
}

AWS provides managed prefix lists for common services (CloudFront, S3, DynamoDB, etc.). This reduces rule count without limiting functionality.

How to fix Error: Error creating Security Group: LimitExceeded in Terraform

What this error means

Typical symptoms

Common causes

How to fix "Error: Error creating Security Group: LimitExceeded"

Advanced notes

Related errors

Official resources & further reading