App Stuck Creating

When you create an OpenSearch UI application, it typically takes a few minutes to become active. However, in some cases the application can appear stuck in the "Creating" state for an extended period. This guide covers the common causes and how to resolve them.

Understanding what's normal helps you identify when something is actually stuck:

1. Open the Amazon OpenSearch Service console
2. Navigate to OpenSearch UI (Dashboards)
3. Find your application in the list
4. Check the Status column

Look at the status field in the response:

The most common cause of a stuck application is missing IAM permissions. The IAM principal creating the application needs a specific set of permissions.

Symptoms:

• Application stays in "Creating" for more than 20 minutes
• No error message in the console
• CloudTrail shows AccessDenied events

Solution:

Ensure the creating principal has these permissions:

The iam:CreateServiceLinkedRole permission is critical — OpenSearch UI creates a service-linked role on first use. If this permission is missing, the application creation silently stalls.

OpenSearch UI uses a service-linked role (AWSServiceRoleForAmazonOpenSearchService) to manage resources on your behalf. If this role can't be created or is in a bad state, application creation fails.

Symptoms:

• First application in the account gets stuck
• CloudTrail shows CreateServiceLinkedRole failures

Solution:

Check if the service-linked role exists:

If it doesn't exist, create it manually:

If it exists but is in a bad state, delete and recreate:

When your application includes VPC-based data sources, the service needs to create VPC endpoints. This can take longer than public domain associations.

Symptoms:

• Application with VPC domains takes 15-20+ minutes
• The associated domain is in a VPC
• No error messages

Solution:

• Wait up to 20 minutes — VPC endpoint creation is inherently slower
• Verify the VPC endpoint authorization is in place:

  Copy

  aws opensearch list-vpc-endpoint-access \
      --domain-name my-vpc-domain

• Check that the domain's security group allows inbound TCP 443

If an associated data source domain is itself in a non-active state (creating, processing, upgrading), the application creation may stall waiting for it.

Symptoms:

• Application stuck in "Creating"
• One or more associated domains are not in "Active" state

Solution:

Check the status of all associated domains:

Wait for all domains to reach Active status before creating the application, or create the application without data sources and add them later:

Service Control Policies (SCPs) in AWS Organizations can block the permissions needed for application creation, even if the IAM policy allows them.

Symptoms:

• IAM permissions look correct
• Application still gets stuck
• CloudTrail shows AccessDenied with an SCP denial

Solution:

• Check SCPs applied to the account in AWS Organizations
• Ensure SCPs allow es:CreateApplication and iam:CreateServiceLinkedRole
• Work with your organization admin to add exceptions if needed

Each region has limits on the number of OpenSearch UI applications you can create. If you've hit the limit, new applications may fail silently.

Symptoms:

• Application creation starts but never completes
• You have many existing applications in the region

Solution:

Check your current application count:

The default limit is typically 10 applications per region. Request a limit increase through the AWS Service Quotas console if needed.

Run through this checklist when your application is stuck:

1. How long has it been? If less than 20 minutes, wait.
2. Check CloudTrail for any AccessDenied or error events:

   Copy

   aws cloudtrail lookup-events \
       --lookup-attributes AttributeKey=EventName,AttributeValue=CreateApplication \
       --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)

3. Verify IAM permissions — especially iam:CreateServiceLinkedRole
4. Check data source health — all associated domains should be Active
5. Check VPC authorization — if using VPC domains
6. Check service quotas — verify you haven't hit the application limit
7. Check SCPs — if the account is in an AWS Organization

If your application has been stuck for more than 30 minutes and you've verified all the above:

1. Delete the stuck application:

   Copy

   aws opensearch delete-application \
       --id app-abc123def456 \
       --region us-east-1

2. Wait 5 minutes for cleanup
3. Fix any identified issues (permissions, VPC, etc.)
4. Create a new application

• Pre-check permissions before creating applications — use the IAM Policy Simulator
• Create applications without data sources first, then add them after the app is active
• Ensure VPC domains are authorized before associating them
• Monitor CloudTrail for early warning signs of permission issues
• Use Infrastructure as Code (Terraform, CloudFormation) to ensure consistent configuration

If none of the above resolves the issue:

1. Note the application ID and region
2. Check CloudTrail for the exact error
3. Open a support case with AWS Support, including:
   • Application ID
   • Region
   • Account ID
   • Time of creation attempt
   • Any CloudTrail error events