Chapter 2. Creating and uploading AWS AMI images
Chapter 2. Creating and uploading AWS AMI images To use your customized RHEL system image in the Amazon Web Services (AWS) cloud, create the system image with Image Builder by using the respective output type, configure your system for uploading the image, and upload the image to your AWS account. 2.1. Preparing to manually upload AWS AMI images Before uploading an AWS AMI image, you must configure a system for uploading the images. Prerequisites You must have an Access Key ID configured in the AWS IAM account manager . You must have a writable S3 bucket prepared. See Creating S3 bucket . Procedure Install Python 3 and the pip tool: Install the AWS command-line tools with pip : Set your profile. The terminal prompts you to provide your credentials, region and output format: Define a name for your bucket and create a bucket: Replace bucketname with the actual bucket name. It must be a globally unique name. As a result, your bucket is created. To grant permission to access the S3 bucket, create a vmimport S3 Role in the AWS Identity and Access Management (IAM), if you have not already done so in the past: Create a trust-policy.json file with the trust policy configuration, in the JSON format. For example: Create a role-policy.json file with the role policy configuration, in the JSON format. For example: Create a role for your Amazon Web Services account, by using the trust-policy.json file: Embed an inline policy document, by using the role-policy.json file: Additional resources Using high-level (s3) commands with the AWS CLI 2.2. Manually uploading an AMI image to AWS by using the CLI You can use RHEL image builder to build ami images and manually upload them directly to Amazon AWS Cloud service provider, by using the CLI. Prerequisites You have an Access Key ID configured in the AWS IAM account manager. You must have a writable S3 bucket prepared. See Creating S3 bucket . You have a defined blueprint. Procedure Using the text editor, create a configuration file with the following content: Replace values in the fields with your credentials for accessKeyID , secretAccessKey , bucket , and region . The IMAGE_KEY value is the name of your VM Image to be uploaded to EC2. Save the file as CONFIGURATION-FILE .toml and close the text editor. Start the compose to upload it to AWS: Replace: blueprint-name with the name of the blueprint you created image-type with the ami image type. image-key with the name of your VM Image to be uploaded to EC2. configuration-file .toml with the name of the configuration file of the cloud provider. Note You must have the correct AWS Identity and Access Management (IAM) settings for the bucket you are going to send your customized image to. You have to set up a policy to your bucket before you are able to upload images to it. Check the status of the image build: After the image upload process is complete, you can see the "FINISHED" status. Verification To confirm that the image upload was successful: Access EC2 on the menu and select the correct region in the AWS console. The image must have the available status, to indicate that it was successfully uploaded. On the dashboard, select your image and click Launch . Additional Resources Required service role to import a VM 2.3. Creating and automatically uploading images to the AWS Cloud AMI You can create a (.raw) image by using RHEL image builder, and choose to check the Upload to AWS checkbox to automatically push the output image that you create directly to the Amazon AWS Cloud AMI service provider. Prerequisites You must have root or wheel group user access to the system. You have opened the RHEL image builder interface of the RHEL web console in a browser. You have created a blueprint. See Creating a blueprint in the web console interface . You must have an Access Key ID configured in the AWS IAM account manager. You must have a writable S3 bucket prepared. Procedure In the RHEL image builder dashboard, click the blueprint name that you previously created. Select the tab Images . Click Create Image to create your customized image. The Create Image window opens. From the Type drop-down menu list, select Amazon Machine Image Disk (.raw) . Check the Upload to AWS checkbox to upload your image to the AWS Cloud and click . To authenticate your access to AWS, type your AWS access key ID and AWS secret access key in the corresponding fields. Click . Note You can view your AWS secret access key only when you create a new Access Key ID. If you do not know your Secret Key, generate a new Access Key ID. Type the name of the image in the Image name field, type the Amazon bucket name in the Amazon S3 bucket name field and type the AWS region field for the bucket you are going to add your customized image to. Click . Review the information and click Finish . Optionally, click Back to modify any incorrect detail. Note You must have the correct IAM settings for the bucket you are going to send your customized image. This procedure uses the IAM Import and Export, so you have to set up a policy to your bucket before you are able to upload images to it. For more information, see Required Permissions for IAM Users . A pop-up on the upper right informs you of the saving progress. It also informs that the image creation has been initiated, the progress of this image creation and the subsequent upload to the AWS Cloud. After the process is complete, you can see the Image build complete status. In a browser, access Service->EC2 . On the AWS console dashboard menu, choose the correct region . The image must have the Available status, to indicate that it is uploaded. On the AWS dashboard, select your image and click Launch . A new window opens. Choose an instance type according to the resources you need to start your image. Click Review and Launch . Review your instance start details. You can edit each section if you need to make any changes. Click Launch Before you start the instance, select a public key to access it. You can either use the key pair you already have or you can create a new key pair. Follow the steps to create a new key pair in EC2 and attach it to the new instance. From the drop-down menu list, select Create a new key pair . Enter the name to the new key pair. It generates a new key pair. Click Download Key Pair to save the new key pair on your local system. Then, you can click Launch Instance to start your instance. You can check the status of the instance, which displays as Initializing . After the instance status is running , the Connect button becomes available. Click Connect . A window appears with instructions on how to connect by using SSH. Select A standalone SSH client as the preferred connection method to and open a terminal. In the location you store your private key, ensure that your key is publicly viewable for SSH to work. To do so, run the command: Connect to your instance by using its Public DNS: Type yes to confirm that you want to continue connecting. As a result, you are connected to your instance over SSH. Verification Check if you are able to perform any action while connected to your instance by using SSH. Additional resources Open a case on Red Hat Customer Portal Connecting to your Linux instance by using SSH
dnf install python3 python3-pip pip3 install awscli aws configure AWS Access Key ID [None]: AWS Secret Access Key [None]: Default region name [None]: Default output format [None]: BUCKET= bucketname aws s3 mb s3://USDBUCKET { "Version": "2022-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "vmie.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:Externalid": "vmimport" } } }] } { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket"], "Resource": ["arn:aws:s3:::%s", "arn:aws:s3:::%s/ "] }, { "Effect": "Allow", "Action": ["ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:RegisterImage", "ec2:Describe "], "Resource": "*" }] } USDBUCKET USDBUCKET aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json provider = "aws" [settings] accessKeyID = " AWS_ACCESS_KEY_ID " secretAccessKey = "AWS_SECRET_ACCESS_KEY" bucket = "AWS_BUCKET" region = "AWS_REGION" key = "IMAGE_KEY" composer-cli compose start blueprint-name image-type image-key configuration-file .toml composer-cli compose status chmod 400 <_your-instance-name.pem_> ssh -i <_your-instance-name.pem_> ec2-user@<_your-instance-IP-address_>