The YAML that is currently live here has errors with regard to the write_files portion. It should look like this:

# NOTE: Cloud-init applies network settings on every boot by default. To retain network 
# settings from first boot, uncomment the following ‘write_files’ section:
# write_files:
#   - 
#     path: /etc/cloud/cloud.cfg.d/80_disable_network_after_firstboot.cfg
#     content: |
#         network:
#             config: disabled

This worked when uncommented and has the path first which is more clear to me.

Also note that for MAC users:

python -c 'import crypt,getpass; print(crypt.crypt(getpass.getpass()))'

This command will not generate the right hash. You have to run something like this:

python -c 'from passlib.hash import sha512_crypt; import getpass; print(sha512_crypt.encrypt(getpass.getpass()))'

monitoring-instances-status-check_sched.md
says "the instance retains its IP address and DNS name"
Does that mean private IP and DNS, public IP and DNS, or both?
I am guessing only the former.

Please explicitly state private, or private and public

Hi!
I'm concerning to AZ with the figure in "scenarios-enis"
I wish it appear AZ border to make it clearly!

Thanks in advance!

There is a path called events/maintenance/ in metadata version 2018-08-17 that isn't documented in the Instance Metadata Categories section of ec2-instance-metadata.md.

In step 5 the command downloads the latest version of of phpMyAdmin (phpMyAdmin-4.8.0) hence step 6 in this guide won't work.
Please update the guide to address the issue.

FIX - STEP 6

[ec2-user html]$ tar -xvzf phpMyAdmin-latest-all-languages.tar.gz
[ec2-user html]$ mv phpMyAdmin-4.8.0-all-languages phpMyAdmin

Hi, I'm following instructions from section Changing the shell prompt without affecting the hostname from https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/set-hostname.md

and I've set NICKNAME to MyServer

but when I switch to root user, then I can't see my nickname/hostname

[ec2-user@MyServer /]$ sudo su
[root@ /]#
[root@ /]# echo $PS1
[\u@ \W]\$

Apart from root user, it works fine.

sudo wget -r --no-parent -A 'epel-release-*.rpm' https://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/

sudo rpm -Uvh dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-*.rpm

sudo yum-config-manager --enable epel*

sudo yum repolist all

sudo yum install -y certbot python2-certbot-nginx

I followed above steps to install certbot on amazon linux instance.

Now when I run the command :
sudo certbot ,

I get following error:
-bash: certbot: command not found

I think it has to do something with the configurations of my instance ,
I have another instance which works correctly with same settings.

Hi There,

This is Adriano and I am using the AWS for an educational purpose and I found a probable mismatch on the tutorial:

Tutorial: Hosting a WordPress Blog with Amazon Linux

• Topic: install the PHP graphics drawing library
• Command: sudo yum install php72-gd
  This command triggered an error message: No package php72-gd available.
  Error: Nothing to do

It looks like library has not been found.

What I did:

1)Run command: rpm -qa | grep gd

• Package looks like installed: php-gd-7.2.27-1.amzn2.x86_64

What I suggest:

• Explain in the guide to check if the library has been installed previously with the command: rpm -qa | grep gd
• Change the command in the tutorial to the correct one: sudo yum install php-gd-7.2.27 (this one seems to be recognized by the shell) in order to install it if not present in the system.

Please be informed on the below:

The previous tutorial followed Install a LAMP Web Server on Amazon Linux 2

Istance used:

NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"

Thanks for your time.
Regards,
Adriano

please add t3.* ENI info in this page
https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/using-eni.md

Thanks

In the Console section, it states that "to connect using the console, the instance must have a public IP address (IPv4 or IPv6).

Is this also a requirement for the other 2 options: CLI or with own key and any SSH Client?

The General Prerequisites also states: We recommend that your instance allows inbound SSH traffic from the recommended IP block published for the service. Use the EC2_INSTANCE_CONNECT filter for the service parameter to get the IP address ranges in the EC2 Instance Connect subset. For more information, see AWS IP Address Ranges in the Amazon Web Services General Reference.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-methods.html

We're looking for examples of the IAM policies that you're using to control access to your EC2 resources.

You can add a comment here or submit a pull request for one of these pages: https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/iam-policies-ec2-console.md or https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/ExamplePolicies_EC2.md.

The bandwidth limits listed here are useful, but it is not clear whether this is total available bandwidth (in + out) or symmetrical bandwidth, where the maximum is available to both in and out simultaneously. From my experience, it is the later, but it would be great for this to be officially spelled out in the docs.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-optimized.html

Hello,
I would like to generate the documentation myself (ideally in PDF) but the repository does not contain any script to do so.

Some have such as https://github.com/awsdocs/aws-ios-developer-guide
Feel free to close this issue if it is not relevant or supported.

Thanks!

Finding a Linux AMI describes general approaches on how to find AMI using Amazon Console and AWS CLI. And it's been in top places with similar search terms, even with Amazon Linux AMI ID. There's a more convenient way for (some) latest amzn AMI ID, which IMHO is the best answer to the search term.

Would be great if you can mention it in Finding a Linux AMI, Amazon Linux product page, or both.

Need to update the image to include the "Stop-Hibernate" option.

The sample to restrict launching certain instance types, which used StringEquals to compare multiple instance types.
"Condition": {
"StringEquals": {
"ec2:InstanceType": ["t2.micro", "t2.small"]
}
}

"Condition": {
"StringNotEquals": {
"ec2:InstanceType": ["t2.micro", "t2.small"]
}
}

I tested the policy examples, it seems not working unless adding set operators.

Hey,
In AWS Documentation and ec2-instance-lifecycle.md, there is an issue in the Instance Lifecycle.

I can stop an instance in pending status.
I did it using AWS CLI, AWS SDK and AWS Console.

According to the documentation, I can't do this transition.

Is there an issue in the documentation?
Is there an issue handling instance states?

Kind regards,
Matías Ponchón

The second chart under General Purpose SSD (gp2) Volumes, which shows the relationship between Maximum IOPS and Volume Size, is incorrect.

The orange line must indicate Baseline Performance while the blue one is for Burst IOPS.

Strangely, this issue exists only in the English version of the page.

Hi All ,

There is no RSS feed for this guide .
Can you please look into adding the following functionality to this guide so we can follow updates added to the guide ?

see :
https://help.github.com/en/articles/atom-rss-feeds-for-github-pages

https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/spot-data-feeds.md#data-feed-file-name-and-format

The "Max" in MyMaxPrice is misleading and can misconstrued as (My) Max Bid.

Example use case is p2.xlarge where On-Demand price is $0.90, Spot is ~$.038 and Spot 1-hr Reserved Duration is $0.495. In this scenario, my "Max Bid Price" is equal to the On-Demand by default.

According to a support case response (6762523391)

The amount 0.495 USD refers to the spot price for that hour and not the max bid price. ... You pay the Spot price that's in effect at the beginning of each instance-hour for your running instance, billed to the nearest second. Further with Spot Instances, you never pay more than the maximum price you specify. If the Spot price exceeds your maximum price ( max bid price which is 0.90 USD) for a given instance or if capacity is no longer available, your instance will automatically be terminated

So, MyMaxPrice refers to the calculated rate of the instance within the given hour and has nothing to do with the Max Bid. In fact, the "Max" here really doesn't have any meaning here.

Given an output (where an instance ran 10-15 minutes):

Timestamp UsageType Operation InstanceID MyBidID MyMaxPrice MarketPrice Charge Version
2020-01-21 19:09:02 UTC	SpotUsage:p2.xlarge	RunInstances:SV006	i-03b7a317447e38aa8	sir-8fd1kt2k	0.495 USD	0.386 USD	0.088 USD	1

$0.495 is the spot instance rate (with a reserved duration of 60 minutes), which is why the price is higher than the $0.386 market price.

Further clarity would be nice, not sure if it is possible to rename the headers:

MyMaxPrice MarketPrice Charge
MySpotPrice MarketPrice Charged

If that's not possible then:
MyMaxPrice | The maximum price specified for this Spot Instance request.
to
MyMaxPrice | The calculated hourly rate of the spot instance which you will pay in that given hour (timestamp).

You might also clarify:
Charge |The price charged for this instance usage.
to
Charge|The total price charged based on the total instance usage to the nearest second.

Row 3, Col 3 is a copy-paste of Row 3, Col 2.

Is it possible with the Snapshot Lifecycle Manager to attach the snapshot the same or specific tags like used "Name" in the volumes?

Do those unit (Mib/s) for throughput right? Isn't it MiB/s?

Maximum bandwidth (Mib/s) | Maximum throughput (Mib/s, 128 KiB I/O)

Baseline bandwidth (Mib/s) | Baseline throughput (Mib/s, 128 KiB I/O)

Hello,
It'd be worth documenting if AWS would restart (or not) instances running on a dedicated host in case of permanent failure.

Hi, I don't think this is the correct area to raise this issue, but I am unaware of the correct area.

If anyone knows, please direct me and I will close this issue.

I was looking through the AWS EC2 Pricing charts and found that the sorting functionality works roughly as expected except for the "Memory" column which sorts lexicographically instead of by amount of memory.

This isn't a huge issue, but I have to imagine it could fool someone quickly searching for the largest and smallest memory instances.

The AWS limited version of cloud-init is not documented. My request is to do so, or to insert a link on this page to such documentation if it already exists.

At https://github.com/awsdocs/amazon-ec2-user-guide/blame/8dcc07c085c9903dbb690447fe2d18458f51a0d9/doc_source/user-data.md#L119 is written

The Amazon Linux version of cloud-init does not support all of the directives that are available in the base package, and some of the directives have been renamed (such as repo_update instead of apt-upgrade).

I could find no AWS documentation which lists what directives are/not supported. No documentation which lists all directives that have been renamed. It is not possible for AWS customers to write this documentation, as we do not know how AWS has changed the canonical cloud-init capabilities. Customers reverse-engineering and trial/error would be exhaustive and error-prone.

Random docs I did find:

• This same page lists that apt-upgrade was renamed to repo_update. Please note that very sentence itself is errant. The correct sentence would be "...such as repo_upgrade instead of apt-upgrade
• https://aws.amazon.com/amazon-linux-2/release-notes/ that Amazon Linux 2 at some point was updated to cloud-init 18.2, but given the prior text it is unclear what that means since cloud-init is not fully implemented - nor is it clear 18.2 is the current limited version.

The current dedicated hosts overview says

There are no performance, security, or physical differences between Dedicated Instances and instances on Dedicated Hosts.

However, The current instance purchasing options says

Dedicated Hosts can help you address compliance requirements and...

So, if there are no security differences between Dedicated Instances and instances on Dedicated Hosts, then Dedicated Instances should also be coverig compliance requirements?

I need to create a policy which will enforce ec2 RunInstance with defined six tag key with any value for my cost explorer visibility.

Any request for RunInstance without these six tags key should not create an instance.

ForAllValues, ForAnyValue is not helping here - https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html because these two are based on request set validation.

aws:RequestTag/keys is not helping because it's required values for keys.

Need help to fix this

Hi, I noticed here in the 2 sample policies, specific resources are specified.

However, from reading https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonec2instanceconnectservice.html and trying in the policy editor, I get the following message: all resources have been selected for you because this service does not allow you to choose specific resources.

Thus, I believe for both of the sample policies should have the following for the resource block: "Resource": "*"

Hello,
File doc_source/ebs-volume-types.md is not consistent with the AWS online doc itself.

For example:

In fact the online doc has a 4-column table, but the doc here on github only has a 2-column table with incorrect title for the 2nd column header.

People use documentation to discover the functionality of AWS products they are interested in. It is crucial this documentation reflect the true state of the features so that people do not waste time or become disappointed in the AWS product under review.

Please consider updating the documentation to reflect a problem with AL2 ( Amazon Linux 2 ) where the seed.iso method for updating network setting upon boot does not work for all recent versions of the image using vmware virtualization.

AWS Documentation
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-linux-2-virtual-machine.html

Supporting:

Forum link https://forums.aws.amazon.com/thread.jspa?messageID=971373&#971373

It appears as though this is method is broken and has been for some time.

This needs to be highlighted in the documentation, rather than wasting peoples time.

From the forum:

This is sadly still broken with the latest 2.0.20210126.0 release.
The documentation in the README.cloud-init is broken, as is the document here:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-linux-2-virtual-machine.html
The linked reply with a diff to fix cloud-init does look like it would work, but there's no way to patch this at boot time that I can >see. I'm really stuck trying to figure out how to work around this, and I'm still stuck loading a two year old image and then >upgrading it. Really frustrating - I've tried all sorts of yaml config variants for the seed.iso with no luck.

Forum link showing heath@aws seems to acknowledge the problem but I am not seeing any final resolution and it does not work in latest AL2 image.

https://forums.aws.amazon.com/thread.jspa?messageID=971374&#971374

Additional alternatives:

#123

In Step 4, the docs say "The following AWS public certificate is for all AWS Regions, except Hong Kong, Bahrain, China, and GovCloud." However, the certificate for GovCloud region is now the same as the one in this tab. Should the tab and call out for GovCloud be removed if the region now uses the same certificate?

What's the procedure to delete / disable ENA on Debian setup via DKMS?

Multi-Volume Snapshots needs a better explanation. Is this instance type policies? There is no difference in the steps between Working with Amazon DLM Using the Console and Working with Amazon DLM to Create and Maintain Multi-Volume Snapshots Using the Console.

Can you alse please explain what VariableTags are?

Hi,

There seems to be a missing info on the EC2 FAQ. I know that this github repo is for EC2 User Guide so I couldn't do a pull request, so I guess I'll just report here anyway. In the https://aws.amazon.com/ec2/faqs/#spot-instances FAQ, it says:

Below is an example of a detailed billing report. The two highlighted areas show how the new report will look based on decimal hours.

But there's no example below that paragraph as shown below.

https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/using-eni.md

With the recent release of the ability to assign prefixes to network interfaces during creation, should this be updated to reflect that change?

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/work-with-prefixes.html

doc_source/ami-boot.md says:

Intel and AMD instance types that support UEFI, in addition to Legacy BIOS:
Virtualized: C5, C5a, C5ad, C5d, C5n, D3, D3en, G4, I3en, M5, M5a, M5ad, M5d, M5dn, M5n, M5zn, R5, R5a, R5ad, R5b, R5d, R5dn, R5n, T3, T3a, and z1d

I'm assuming that M6i should be on this list; also any future Ice Lake instance types.

The doc says,

Amazon EBS delivers within 10 percent of the provisioned IOPS performance 99.9 percent of the time over a given year.

Does it mean the PIOPS SSD only gets 10% provisioned IOPS performance in a given year?

Should it be corrected as below,

Amazon EBS delivers at least 90 percent of the provisioned IOPS performance 99.9 percent of the time over a given year.

I am currently in the process of trying to provision several /23 blocks to my account via the aws cli. I am running into an issue with --cidr-authorization-context. What do the "message" and "signature" need to look like?

I followed all steps in "Connecting to your Linux instance if you lose your private key" to step 8 "Connect to the original instance using the new key pair". no ssh response- get error message "network error connection timed out". anyone can help on this?

Hi,

I think there is an error at this line :

Should be : (with service-role between role/ and /AWSDataLifecycleManagerDefaultRole)

{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Action": ["iam:PassRole", "iam:ListRoles"],
        "Resource": "arn:aws:iam::123456789012:role/service-role/AWSDataLifecycleManagerDefaultRole"
    },
    {
        "Effect": "Allow", 
        "Action": "dlm:*",
        "Resource": "*"
    }]
}

Have a nice day.

Tried launching an EC2 instance using a launch template from the command line but it wanted me to supply an --image-id. I manually launched a new instance from a launch template via the console to verify the template worked. Attempted to launch from template on the command line again, but also providing the --image-id as requested, resulting in an unknown option error.

Come to find out, aws ec2 run-instances no longer recognizes the --launch-template option, as also verified by its absence when running aws ec2 run-instances help. Has this been deprecated?

Question also asked over at StackOverflow here.

Hello,

I am trying to set up an Amazon Linux 2 instance on premise outside of AWS, more specifically through VMWare ESXi virtualization platform. I have completed all three steps according to the amazon-linux-2-virtual-machine.md guide (making meta-data and user-data and seed.iso, download the image and mount seed.iso during the first boot.) However, during the log in, i keep on getting login incorrect while trying to use the credentials defined in user-data. Pretty sure i didnt just make typos. Any help is appreciated, thank you!

It looks like in the initial commit of all the docs to this repo, the documentation on compiling and enabling the ENA module for linux included the actual dkms commands and the dkms.conf required to perform the compilation. (See: d1a4d62#diff-9907c334785b20f7c26dc2cd4fa82265)

However, these instructions were listed under the Ubuntu section and when the docs were updated to remove the details for Ubuntu in favor of the new method for Ubuntu, the details needed for other linux distros such as CentOS were effectively removed.

At present the documentation reads simply:

Compile and install the ena module on your instance.

This is difficult because if you're new to the process you're left with no idea of what to do next.

Please consider restoring these required steps to the documentation for the Other Linux distros including the sample dkms.conf file. Also, please consider documenting the proper way to keep up with the version of the module. As written, it's version 1.0.0 and version 2.0.2g is what's out now.

Thanks!

In the first table with these column headers:
"Instance size | Maximum bandwidth (Mbps) | Maximum throughput (MB/s, 128 KiB I/O) | Maximum IOPS (16 KiB I/O)"

the numbers for the x2gd instances are in the wrong columns or just wrong.

For example, for x2gd.metal, IOPS should be 152,000 and bandwidth should be 19,000. The third number (80,000) is not the throughput number - that's an IOPS number from other instance types.

An announcement says that gp2 volumes now have a maximum baseline performance of 16,000 IOPS, but the table under "I/O Credits and Burst Performance" in EBSVolumeTypes.md still says it's 10,000 IOPS.

Also, under "What happens if I empty my I/O credit balance?" it still says "... or switching to an io1 volume for workloads that require sustained IOPS performance greater than 10,000 IOPS."

Hi Team,

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

above page has defined network interface attributes, but below points are not clear

One Elastic IP address (IPv4) per private IPv4 address
One public IPv4 address

Elastic IP address it self means public ip address, so why it means by one Elastic IP address per IP4 address and One public ip address

How many public ip address are possible ?

thank you
dheeraj Kumar

I followed all the instructions in the article Run Amazon Linux 2 as a virtual machine on premises.
I am using Oracle VirtualBox on Windows10. The port forwarding for Port 22 is enabled for the VM.
I also modified /etc/ssh/sshd_config to change PasswordAuthentication to yes and did sudo service sshd restart .
I am able to login into the VM using the default EC2-user.
But I am not able to ssh into the VM.
What else am I missing? Is is mandatory to generate keys for accessing the instance using ssh? How do I generate the keys for the default ec-2 user in this case?

Hello,
On URI:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-interruptions.html
it is stated hibernate would work with:
"The following instances are supported: C3, C4, C5, M4, M5, R3, and R4, with less than 100 GB of memory."
in the non-spot documentation, the following is specified:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Hibernate.html
"The following instance families are supported: C3, C4, C5, M3, M4, M5, R3, R4, and R5, with less than 150 GB of RAM"

Is the difference expected ?

The "Run Amazon Linux 2 as a virtual machine on premises" page describes a fairly cumbersome way of running Amazon Linux 2 in local virtual machines through using various tools to provision ISO9660 seed.iso files just to serve the VM instance two small data files.

It would be great it the documentation also pointed out that since the VM provisioning is being done with cloud-init, and the image has configured a fairly extensive datasource_list: [ NoCloud, AltCloud, ConfigDrive, OVF, None ] which starts with NoCloud, that NoCloud also allows you to serve these files over HTTP.

There are two easy ways of using network configuration instead of seed.iso. Either you tell GRUB to add a parameter to the kernel boot configuration, or you tell KVM/VMWare/Virtualbox to set the virtual machine's SMBIOS value to something which cloud-init's NoCloud understands.

The documentation page https://cloudinit.readthedocs.io/en/latest/topics/datasources/nocloud.html describes the parameters.

If you wish to use Packer, for example, to provision local KVM qcow2 files of AL2, you'd use a configuration which looks a bit like this:

{
  "builders": [
    {
      "vm_name": "alpha",
      "type": "qemu",
      "accelerator": "kvm",
      "qemuargs": [
        ["-display", "none"],
        ["-smbios", "type=1,serial=ds=nocloud-net;s=http://{{ .HTTPIP }}:{{ .HTTPPort }}/"]
      ],
      "format": "qcow2",
      "iso_url": "images/amzn2-kvm-2.0.20200602.0-x86_64.xfs.gpt.qcow2",
      "iso_checksum": "sha256:1ca3af1df04dd9c46240414be3fbc024cdd1fab5fe9b00a975614f24e682da85",
      "disk_image": true,

      "ssh_handshake_attempts": "20",
      "ssh_username": "ec2-user",

      "net_device": "virtio-net",
      "disk_interface": "virtio",

      "http_directory": "httpserver",
      "output_directory": "output"

    }
  ]
}

the sillier way to achieve the same is to tell your VM creator to send keypresses to the virtual terminal which is booting up AL2 for the first time:

"boot_wait": "1s",
"boot_command": [
    "<shift><shift><wait><wait>e<down><down><down><down><down><down><down><down><down><down><down><down><left>",
    " ds=nocloud-net;s=http://{{ .HTTPIP }}:{{ .HTTPPort }}/",
    "<leftCtrlOn>x<leftCtrlOff>"
  ]