Skaperen's questions

I am unable to find details in the documentation or Google searches of spot instance limitations in regard to IP addressing. I have tried to do experiments to see what might work using the web based console, the AWS CLI, and the AWS API. So I am either unable find ways to make these requests, or where I have tried what I hoped might work did not work. I would like to know if these capabilities are supposed to work by some means for a spot instance:

1. Be assigned and use a random private IPv4 address.
2. Be assigned and use a specified private IPv4 address.
3. Be assigned and use a random public IPv6 address.
4. Be assigned and use a specified public IPv6 address.

Number 1 worked, but I was unable to find a way to make the others work. Example 3 in http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-request-examples.html seems to imply that user specified addressing is limited in spot instances.

edit 1:

The web console instructions in http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/MultipleIP.html work for adding an IPv4 address to a network interface. But for adding an IPv6 address to a network interface, they do not. There are no error messages, but the addresses are not added.

edit 2:

The web console does not work for adding a specific IPv6 address to a network interface or to create a network interface with a specific IPv6 address. The awscli package in Ubuntu does not include IPv6 subcommands and options. However, the awscli package in Python pip does. I have succeeded adding an IPv6 address to a spot instance by attaching a network interface with an IPv6 address to it.

I want to set up a VPN from one EC2 instance in a default VPC the other instances in the same VPC can use so I am doing some initial tests. I have 2 test instances running and they can ping each other. When I route a test public IP from one to the other the packets do go out from eth0 of the sender instance (as seen by tcpdump with the expected target MAC address (so I guess I have host routing set right) but never arrive at the target instance. I have tested this 2 ways, one via 172.31.0.1 , and also directly using the IP of the other instance as the gateway. iptables on both hosts (Ubuntu and Amazon Linux both tested) is empty. The test public IP was added as a route on the VPC master routing table using the test receive instance as the gateway.

My goal is that instances I launch in that VPC that send to any non-VPC IP end up going to the instance I run the VPN on (still undecided between IPsec or OpenVPN). How can I get the packets to go through on EC2 over a default VPC? I suspect there is more to this than I find in the AWS docs or via Google (maybe some other EC2 object ... do I have all the concepts right?).

I am making a new AMI in EC2 and want to disable it running anything that could be put in user-data when launching (or rebooting) from this AMI. I looked at the existing /etc/cloud/cloud.cfg and /etc/cloud/cloud.cfg.d/* but do not see where this is enabled (so maybe it is on by default). How can I reconfigure cloud-init to not allow this or even allow this to be re-enbled? I suspect I also need to disable #cloud-config. Do I need to disable the whole cloud-init package to achieve this?

edit:

I will be using Amazon Linux and Ubuntu in various AMIs.

edit2:

It looks like I need to disable all of user-data. Maybe that will be easier.

edit3:

I do want to be able to access the user-data in my scripts.

I am using the "aws ec2 run-instances" command (from the AWS Command Line Interface (CLI)) to launch an Amazon EC2 instance. I want to set an IAM role for the EC2 instance I am launching. The IAM role is configured and I can use it successfully when launching an instance from the AWS web UI. But when I try to do this using that command, and the "--iam-instance-profile" option, it failed. Doing "aws ec2 run-instances help" shows Arn= and Name= subfields for the value. When I try to look up the Arn using "aws iam list-instance-profiles" it gives this error message:

A client error (AccessDenied) occurred: User: arn:aws:sts::xxxxxxxxxxxx:assumed-role/shell/i-15c2766d is not authorized to perform: iam:ListInstanceProfiles on resource: arn:aws:iam::xxxxxxxxxxxx:instance-profile/

(where xxxxxxxxxxxx is my AWS 12-digit account number)

I looked up the Arn string via the web UI and used that via "--iam-instance-profile Arn=arn:aws:iam::xxxxxxxxxxxx:instance-profile/shell" on the run-instances command, and that failed with:

A client error (UnauthorizedOperation) occurred: You are not authorized to perform this operation.

If I leave off the "--iam-instance-profile" option entirely, the instance will launch but it will not have the IAM role setting I need. So the permission seems to have something to do with using "--iam-instance-profile" or accessing IAM data. I repeated several times in case of AWS glitches (they happen sometimes) and no success.

I suspected that perhaps there is a restriction that an instance with an IAM role is not allowed to launch an instance with a more powerful IAM role. But in this case, the instance I am doing the command in has the same IAM role that I am trying to use. named "shell" (though I also tried using another one, no luck).

• Is setting an IAM role not even permitted from an instance (via its IAM role credentials)?

• Is there some higher IAM role permission needed to use IAM roles, than is needed for just launching a plain instance?

• Is "--iam-instance-profile" the appropriate way to specify an IAM role?

• Do I need to use a subset of the Arn string, or format it in some other way?

• Is it possible to set up an IAM role that can do any IAM role accesses (maybe a "Super Root IAM" ... making up this name)?

FYI, everything involves Linux running on the instances. Also, I am running all this from an instance because I could not get these tools installed on my desktop. That and I do not want to put my IAM user credentials on any AWS storage as advised by AWS here.

after answered:

I did not mention the launching instance permission of "PowerUserAccess" (vs. "AdministratorAccess") because I did not realize additional access was needed at the time the question was asked. I assumed that the IAM role was "information" attached to the launch. But it really is more than that. It is a granting of permission.

I can touch the file /.autorelabel and reboot and during the initialization coming back up it will do the SELINUX relabel for me. But I want to do this in a different situation where the system has just been copied to a hard drive image. I can chroot to the originating file tree, or chroot to the just populated device image and run it. I just can't find anything that says what to be run.

This image is being made into an AMI on AWS EC2, and contains CentOS 6.3. But the time it takes to relabel is too long (6 minutes or more). I want to move the relabel to the image build where the extra time is not an issue (because it happens once instead of every time an AMI is launched). I can make this relabel be the very last thing just before the filesystem is unmounted for the last time until it becomes an AMI and will launch. I just need to know what to call to do it.

I have searched man pages with no luck. I have searched system init scripts but where /.autorelabel is detected, it is unclear what is happening.

Documents like http://www.centos.org/docs/5/html/5.2/Deployment_Guide/sec-sel-fsrelabel.html only tell how to do things that still really do the work after a reboot. I need to have the work doing BEFORE the "reboot" (unmount, build AMI, and launch ready to go).

The big point is ... yes there will be a reboot ... but I want the relabel work to be done before that so it won't be done every time an AMI is launched (because it takes so long).

I am wanting to run rsync over an SSL/TLS encrypted connection. It does not do this directly so I am exploring options. The stunnel program looks promising, although more complicated than designed due to the need to hop connections with the -r option. However, I do find there is a -l option to run a program. I am assuming this works by having two processes, one to carry out the SSL/TLS work, and one to be the worker which the client is communicating to. These would then communicate by a pipe pair or two way socket between them.

What struck me as odd when I surveyed a number of web pages to see how to properly set this up is that whether running as a standalone daemon, or under a super daemon like inetd, the arguments for rsync are the same. How does rsync --daemon know whether it should open a socket and listen on it for many connections, or just service one connection by communicating with the stdin/stdout descriptors is has when it starts up (which really would go through the extra process to handle the encryption, description, and SSL/TLS protocol layer)?

And then I need to find a way to wrap the client to have it do SSL/TLS in one simple command (as opposed to connection hopping that stunnel seems to favor).

I have an old machine running Linux kernel 2.6.26.2 which is behaving oddly. I suspect ONE of the CPUs is possibly heating faster than the other. I want to run some tests with specific CPUs/cores disabled and enabled. I googled for directions, and the only matches I find are number of CPUs at boot time via kernel parameters, or setting /sys/devices/system/cpu/cpuX/online with 0 or 1. But /sys/devices/system/cpu/cpuX/online does not exist. However, /sys/devices/system/cpu/online does. I re-googled for that path, but Google insists on matching pages with /sys/devices/system/cpu/cpuX/online anyway (doesn't highlight the cpuX part). Searching kernel source finds one document that has the path, but no explanation of what to set. The current contents of /sys/devices/system/cpu/online is "0-3". I'd like to know what value to set here for each different CPU to test, possibly testing all 15 combinations of on/off. This machine is a dual-socket each with "Dual-Core AMD Opteron(tm) Processor 2220" at 2.8 GHz.

On AWS I have managed to create an AMI with a modified Ubuntu 12.04 LTS amd64. I've added lots of packages and much of our own code and files. The cloud init is still there, and I'm sure should stay. However, it is undermining my automations by re-disabling root at run time, after I enabled it in the original volume that was used to create the snapshot for the AMI.

File /usr/share/pyshared/cloudinit/CloudConfig/cc_ssh.py appears to be connected to this. Since I am not experienced in Python coding, I have no idea what some of the functions it calls are, so I cannot really see what all this script is doing.

I could just add some init script of my own to run afterwards, somewhere, to just undo that and re-enable root. Is there a way, standardized or sanctioned by cloud init, to set a flag to indicate that disabling root login should not be done? Or should I just roll my own solution (later init to put back my own /root/.ssh/authorized_keys file).

I also see that this script is removing old host keys and regenerating new ones. That is something I'd like to keep (therefore I will not need to do this myself).

I also have the SSH listening port number changed to a number other than 22 (and security group set to allow access to that port only from my own IPs). That much did not get changed. This is good.

Is there a way to attach an AMI, or a copy thereof, to an instance? This would be a non-pay public Linux AMI. An example would be the Ubuntu 12.04 LTS AMI. But I don't want to be limited to just that one, either (so a copy of it elsewhere, while nice to know, isn't the answer). In particular, what I am trying to avoid is making a copy that is running or has been run.

The test would then be to make a snapshot of that, and register that as an AMI, and it would be an exact copy. My intention would be to modify the copy (as my own volume). But my modifications would not work if it is a root device initially (since the transition of changes would cause a crash).

I have a file tree in a directory. This is used to build bootable systems on hard drives and flash drives. I've also used it to build images for virtual machines. I would like to make an AWS AMI from it (plus whatever tweaks are needed to make it cloud worthy, like the cloud-init stuff). For now I am exploring how to make an EBS backed AMI. All the documentation and answered questions I have found focus on other ways to build AMIs, and involve using existing AMIs, or starting instances and saving what's in a running state. But I want to make something from scratch based on my system setup.

I envisioned a couple ways to do this based on what I can figure out from AWS documentation (nothing literally addresses by needs). In both cases I create a new volume and attach it to an instance running an arbitrary Linux AMI. In method A, in that instance I format the volume with ext4, mount it as /mnt/xvdf, then run rsync to upload my system file tree into the volume itself, and then unmount it. In method B, I create a loopback file on my home machine, format it, mount it, populate it from the system tree, unmount it, and and transmit the image file to the instance with the volume attached, and just copy the image to the volume device such much like dd. In both cases I would end up with a filesystem on the volume likes like I have on hard drives, flash drives, and VM image files (raw).

Then I make a snapshot of that volume and register it as an AMI. But it does not work. The error obtained from the instance log is that the kernel panicked because the filesystem type could not be mounted (has an unsupported feature).

Am i basically doing the right process and just goofed up a step (like formatting a filesystem type it doesn't like ... I am using ext4)?

Or am I doing it wrong? It did get far enough that it let me register the AMI, and launch an instance from it.

I'm sure I need to make many tweaks to the file tree to get it to work right in the cloud environment. I will be learning what those are. But right now it has not gotten far enough to even consider whether my files are right or wrong.

Please don't suggest for me to try making an S3-backed AMI or make one from a running instance. I do plan to try those methods as part of learning everything, but those are later. This is now and the goal is to make an AMI from an unbooted scratch image/tree (which works in other places).