diff --git a/changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml b/changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml
new file mode 100644
index 00000000000..a9e18bdf75c
--- /dev/null
+++ b/changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml
@@ -0,0 +1,5 @@
+changelog:
+- type: FIX
+  issueLink: https://github.com/solo-io/gloo/issues/0000
+  resolvesIssue: false
+  description: Add ERROR level logging when EC2 upstream discovery fails due to invalid or missing AWS credentials.
diff --git a/projects/gloo/pkg/plugins/aws/ec2/eds.go b/projects/gloo/pkg/plugins/aws/ec2/eds.go
index c508ac8c5da..759b8d4d064 100644
--- a/projects/gloo/pkg/plugins/aws/ec2/eds.go
+++ b/projects/gloo/pkg/plugins/aws/ec2/eds.go
@@ -92,6 +92,7 @@ func (c *edsWatcher) updateEndpointsList(endpointsChan chan v1.EndpointList, err
 	for _, ns := range c.secretNamespaces {
 		nsSecrets, err := c.secretClient.List(ns, clients.ListOpts{Ctx: c.watchContext})
 		if err != nil {
+			contextutils.LoggerFrom(c.watchContext).Errorw("failed to list secrets for EC2 upstream discovery", "namespace", ns, "error", err)
 			errs <- err
 			return
 		}
@@ -100,6 +101,7 @@ func (c *edsWatcher) updateEndpointsList(endpointsChan chan v1.EndpointList, err
 
 	allEndpoints, err := getLatestEndpoints(c.watchContext, c.ec2InstanceLister, secrets, c.writeNamespace, c.upstreams)
 	if err != nil {
+		contextutils.LoggerFrom(c.watchContext).Errorw("failed to fetch EC2 instances for upstream discovery", "error", err)
 		errs <- err
 		return
 	}