Terraform "LimitExceeded" service quota in CI

By Daniel Zoghalchali·Latchkey

AWS enforces per-account, per-region service quotas. Terraform requested a resource that would exceed a quota -- too many VPCs, Elastic IPs, or instances -- so the create was rejected.

What this error means

apply fails with LimitExceeded (e.g. AddressLimitExceeded, VpcLimitExceeded) naming the limit. It is not a permissions or transient error -- the account is at its allotted count for that resource.

terraform

Error: creating EC2 EIP: operation error EC2: AllocateAddress,
https response error StatusCode: 400, AddressLimitExceeded: The maximum number
of addresses has been reached.

  with aws_eip.nat,
  on network.tf line 30, in resource "aws_eip" "nat":

Diagnose it: init, state, or credentials?

Terraform failures in CI are dominated by backend and credential problems rather than configuration errors. Confirm the runner can initialise, authenticate, and lock state before reading the plan.

Terminal

terraform init -backend=true -input=false
terraform validate
terraform providers
terraform plan -input=false -no-color -detailed-exitcode
#   0 = no changes, 2 = changes, 1 = error

Common causes

Account at the service quota

The account already holds the maximum number of that resource in the region, so a new one cannot be allocated.

Leaked resources from failed runs

Orphaned EIPs, ENIs, or instances from earlier failed applies consume quota that the current run needs.

How to fix it

Request a quota increase or free up resources

Raise the Service Quotas limit, or release leaked resources before retrying.

Terminal

aws service-quotas request-service-quota-increase \
  --service-code ec2 \
  --quota-code L-0263D0A3 \
  --desired-value 10
# or release orphaned EIPs first:
aws ec2 describe-addresses --query 'Addresses[?AssociationId==`null`]'

Reduce footprint or consolidate

Reuse shared resources (one NAT gateway/EIP per AZ) instead of per-stack copies.
Clean up orphaned resources from previously failed runs.
Spread workloads across regions if a single region is saturated.

How to prevent it

Track service quotas and request increases ahead of need.
Clean up orphaned resources so failed runs do not leak quota.
Share expensive quota-bound resources rather than duplicating them.

Frequently asked questions

What causes Terraform "LimitExceeded" service quota in CI?

There are 2 common causes: account at the service quota and leaked resources from failed runs. The account already holds the maximum number of that resource in the region, so a new one cannot be allocated.

How do I fix Terraform "LimitExceeded" service quota in CI?

There are 2 fixes depending on which cause you have: request a quota increase or free up resources and reduce footprint or consolidate. Work through them in order, since the first is the most common.

What does Terraform "LimitExceeded" service quota in CI actually mean?

apply fails with LimitExceeded (e.g.

How do I stop Terraform "LimitExceeded" service quota in CI happening again?

Track service quotas and request increases ahead of need. The prevention section lists 3 changes that keep it from recurring.