Ph: 43580406
 
Ubuntu AMIs for Amazon EC2
   us-east-1 
Ubuntu Release Publisher User server
32-bit
server
64-bit
Ubuntu 11.10 Oneiric
EBS boot
Canonical ubuntu@ ami-6ba27502 [image] ami-6fa27506 [image]
Ubuntu 11.10 Oneiric
instance-store
Canonical ubuntu@ ami-d1a671b8 [image] ami-4fa37426 [image]
Ubuntu 11.10 Oneiric
HVM (cluster compute)
Canonical ubuntu@ ami-67a2750e [image]
Ubuntu 11.04 Natty
EBS boot
Canonical ubuntu@ ami-e358958a [image] ami-fd589594 [image]
Ubuntu 11.04 Natty
instance-store
Canonical ubuntu@ ami-c15994a8 [image] [image]ami-71589518 
Ubuntu 11.04 Natty
HVM (cluster compute)
Canonical ubuntu@ ami-f1589598 [image]
Ubuntu 10.10 Maverick
EBS boot
Canonical ubuntu@ ami-f333fe9a [image] ami-cf33fea6 [image]
Ubuntu 10.10 Maverick
instance-store
Canonical ubuntu@ ami-9930fdf0 [image] ami-1933fe70 [image]
Ubuntu 10.04 LTS Lucid
EBS boot
Canonical ubuntu@ ami-71dc0b18 [image] ami-55dc0b3c [image]
Ubuntu 10.04 LTS Lucid
instance-store
Canonical ubuntu@ ami-4fd00726 [image] ami-35de095c [image]
Ubuntu 8.04 LTS Hardy
EBS boot
Alestic ubuntu@ ami-ad9458c4 [image] ami-b19458d8 [image]
Ubuntu 8.04 LTS Hardy
instance-store
Canonical ubuntu@ ami-91579af8 [image] ami-a5569bcc [image]
   us-west-1 
Ubuntu Release Publisher User server
32-bit
server
64-bit
Ubuntu 11.10 Oneiric
EBS boot
Canonical ubuntu@ ami-3f94ca7a [image] ami-c594ca80 [image]
Ubuntu 11.10 Oneiric
instance-store
Canonical ubuntu@ ami-f197c9b4 [image] ami-5b94ca1e [image]
Ubuntu 11.04 Natty
EBS boot
Canonical ubuntu@ [image]ami-43580406  ami-4d580408 [image]
Ubuntu 11.04 Natty
instance-store
Canonical ubuntu@ ami-e95f03ac [image] ami-a15f03e4 [image]
Ubuntu 10.10 Maverick
EBS boot
Canonical ubuntu@ ami-21237f64 [image] ami-23237f66 [image]
Ubuntu 10.10 Maverick
instance-store
Canonical ubuntu@ ami-69237f2c [image] ami-11237f54 [image]
Ubuntu 10.04 LTS Lucid
EBS boot
Canonical ubuntu@ ami-9991cfdc [image] ami-a191cfe4 [image]
Ubuntu 10.04 LTS Lucid
instance-store
Canonical ubuntu@ ami-b390cef6 [image] ami-3991cf7c [image]
Ubuntu 8.04 LTS Hardy
EBS boot
Alestic ubuntu@ ami-1f48145a [image] ami-1948145c [image]
Ubuntu 8.04 LTS Hardy
instance-store
Canonical ubuntu@ ami-0b59054e [image] ami-c7590582 [image]
   us-west-2 
Ubuntu Release Publisher User server
32-bit
server
64-bit
Ubuntu 11.10 Oneiric
EBS boot
Canonical ubuntu@ ami-e4b03dd4 [image] ami-e6b03dd6 [image]
Ubuntu 11.10 Oneiric
instance-store
Canonical ubuntu@ ami-aeb03d9e [image] ami-8eb03dbe [image]
Ubuntu 11.04 Natty
EBS boot
Canonical ubuntu@ ami-18f97428 [image] ami-1af9742a [image]
Ubuntu 11.04 Natty
instance-store
Canonical ubuntu@ ami-10f67b20 [image] ami-16f67b26 [image]
Ubuntu 10.10 Maverick
EBS boot
Canonical ubuntu@ ami-04f97434 [image] ami-06f97436 [image]
Ubuntu 10.10 Maverick
instance-store
Canonical ubuntu@ ami-1ef67b2e [image] ami-00f67b30 [image]
Ubuntu 10.04 LTS Lucid
EBS boot
Canonical ubuntu@ ami-8cb33ebc [image] ami-8eb33ebe [image]
Ubuntu 10.04 LTS Lucid
instance-store
Canonical ubuntu@ ami-bcb33e8c [image] ami-94b33ea4 [image]
Ubuntu 8.04 LTS Hardy
instance-store
Canonical ubuntu@ ami-76f67b46 [image] ami-62f67b52 [image]
   eu-west-1 
Ubuntu Release Publisher User server
32-bit
server
64-bit
Ubuntu 11.10 Oneiric
EBS boot
Canonical ubuntu@ ami-0fe3dc7b [image] ami-09e3dc7d [image]
Ubuntu 11.10 Oneiric
instance-store
Canonical ubuntu@ ami-61e4db15 [image] ami-47e3dc33 [image]
Ubuntu 11.04 Natty
EBS boot
Canonical ubuntu@ ami-a4f7c5d0 [image] ami-a6f7c5d2 [image]
Ubuntu 11.04 Natty
instance-store
Canonical ubuntu@ ami-fef7c58a [image] ami-c0f7c5b4 [image]
Ubuntu 10.10 Maverick
EBS boot
Canonical ubuntu@ ami-020f3d76 [image] ami-0e0f3d7a [image]
Ubuntu 10.10 Maverick
instance-store
Canonical ubuntu@ ami-480f3d3c [image] ami-1a0f3d6e [image]
Ubuntu 10.04 LTS Lucid
EBS boot
Canonical ubuntu@ ami-95dde2e1 [image] ami-81dde2f5 [image]
Ubuntu 10.04 LTS Lucid
instance-store
Canonical ubuntu@ ami-fddee189 [image] ami-3fdde24b [image]
Ubuntu 8.04 LTS Hardy
EBS boot
Alestic ubuntu@ ami-07ecde73 [image] ami-ffecde8b [image]
Ubuntu 8.04 LTS Hardy
instance-store
Canonical ubuntu@ ami-42f5c736 [image] ami-00f5c774 [image]
   ap-southeast-1 
Ubuntu Release Publisher User server
32-bit
server
64-bit
Ubuntu 11.10 Oneiric
EBS boot
Canonical ubuntu@ ami-58cc890a [image] ami-5ecc890c [image]
Ubuntu 11.10 Oneiric
instance-store
Canonical ubuntu@ ami-a6cd88f4 [image] ami-5acc8908 [image]
Ubuntu 11.04 Natty
EBS boot
Canonical ubuntu@ ami-06255f54 [image] ami-04255f56 [image]
Ubuntu 11.04 Natty
instance-store
Canonical ubuntu@ ami-72255f20 [image] ami-7a255f28 [image]
Ubuntu 10.10 Maverick
EBS boot
Canonical ubuntu@ ami-58215b0a [image] ami-5e215b0c [image]
Ubuntu 10.10 Maverick
instance-store
Canonical ubuntu@ ami-52215b00 [image] ami-56215b04 [image]
Ubuntu 10.04 LTS Lucid
EBS boot
Canonical ubuntu@ ami-d8c98c8a [image] ami-c0c98c92 [image]
Ubuntu 10.04 LTS Lucid
instance-store
Canonical ubuntu@ ami-76c98c24 [image] ami-3cc98c6e [image]
Ubuntu 8.04 LTS Hardy
EBS boot
Alestic ubuntu@ ami-d0166c82 [image] ami-d8166c8a [image]
Ubuntu 8.04 LTS Hardy
instance-store
Canonical ubuntu@ ami-521a6000 [image] ami-581a600a [image]
   ap-northeast-1 
Ubuntu Release Publisher User server
32-bit
server
64-bit
Ubuntu 11.10 Oneiric
EBS boot
Canonical ubuntu@ ami-e0fd4be1 [image] ami-e2fd4be3 [image]
Ubuntu 11.10 Oneiric
instance-store
Canonical ubuntu@ ami-5afd4b5b [image] ami-b6fd4bb7 [image]
Ubuntu 11.04 Natty
EBS boot
Canonical ubuntu@ ami-00b10501 [image] ami-02b10503 [image]
Ubuntu 11.04 Natty
instance-store
Canonical ubuntu@ ami-f0b004f1 [image] ami-fab004fb [image]
Ubuntu 10.10 Maverick
EBS boot
Canonical ubuntu@ ami-dab400db [image] ami-dcb400dd [image]
Ubuntu 10.10 Maverick
instance-store
Canonical ubuntu@ ami-cab400cb [image] ami-d6b400d7 [image]
Ubuntu 10.04 LTS Lucid
EBS boot
Canonical ubuntu@ ami-1ae6501b [image] ami-36e65037 [image]
Ubuntu 10.04 LTS Lucid
instance-store
Canonical ubuntu@ ami-46f94f47 [image] ami-baf94fbb [image]
Ubuntu 8.04 LTS Hardy
EBS boot
Alestic ubuntu@ ami-b4a612b5 [image] ami-b6a612b7 [image]
Ubuntu 8.04 LTS Hardy
instance-store
Canonical ubuntu@ ami-d6b105d7 [image] ami-02b20603 [image]
   sa-east-1 
Ubuntu Release Publisher User server
32-bit
server
64-bit
Ubuntu 11.10 Oneiric
EBS boot
Canonical ubuntu@ ami-d220ffcf [image] ami-cc20ffd1 [image]
Ubuntu 11.10 Oneiric
instance-store
Canonical ubuntu@ ami-be20ffa3 [image] ami-de20ffc3 [image]
Ubuntu 11.04 Natty
EBS boot
Canonical ubuntu@ ami-e23ae5ff [image] ami-1e39e603 [image]
Ubuntu 11.04 Natty
instance-store
Canonical ubuntu@ ami-e63ae5fb [image] ami-e03ae5fd [image]
Ubuntu 10.10 Maverick
EBS boot
Canonical ubuntu@ ami-6235ea7f [image] ami-9c35ea81 [image]
Ubuntu 10.10 Maverick
instance-store
Canonical ubuntu@ ami-e83ae5f5 [image] ami-ea3ae5f7 [image]
Ubuntu 10.04 LTS Lucid
EBS boot
Canonical ubuntu@ ami-6a5f8077 [image] ami-645f8079 [image]
Ubuntu 10.04 LTS Lucid
instance-store
Canonical ubuntu@ ami-4a5f8057 [image] ami-7a5f8067 [image]
Ubuntu 8.04 LTS Hardy
EBS boot
Alestic ubuntu@
Ubuntu 8.04 LTS Hardy
instance-store
Canonical ubuntu@ ami-fa3ae5e7 [image] ami-f03ae5ed [image]


Amazon Elastic Compute Cloud (EC2)] provides self-serve, on-demand servers where you pay for the capacity you use. The Ubuntu images listed above are publicly available for use by the EC2 community.

AMIs listed as "Canonical" are published by Canonical, the commercial sponsor of Ubuntu. AMIs listed as "Alestic" are published by Eric Hammond.

Each row indicates the ssh account which should be used to access a new instance of the AMIs, either "ubuntu@" or "root@".

The "EBS boot" AMIs use the corresponding image in the AMI built by Canonical, but the root disk is a persistent EBS volume instead of ephemeral storage.

The "HVM" AMIs are only usable with Amazon EC2's "cluster compute" instance types.

Note: The Debian AMIs published years ago under the Alestic name are still available on EC2, but are out of date, not upgradable, no longer recommended, and no longer supported. Check here for some Debian AMIs being created by the community: http://wiki.debian.org/Cloud/AmazonEC2Image

The source for ec2-conssitent-snapshot has historically been available here:

For your convenience, it is now also available here:

You are welcome to fork ec2-consistent snapshot under the liberal terms of the Apache License, Version 2.0.

I welcome patch submissions, especially if:

The patch accomplishes a single enhancement or bug fix, changing as little as possible to accomplish the goals, while still performing appropriate error checks.

The patch includes relevant updates to the documentation.

The patch does not add functionality outside of the narrow goal of ec2-consistent-snapshot (initiate EBS snapshots with consistent filesystems and application data).

The patch is created against the latest version of the source.

I also recommend submitting a bug/feature in Launchpad.net to track adding the patch to ec2-consistent-snapshot:

https://bugs.launchpad.net/ec2-consistent-snapshot/+filebug

Not all patches will be accepted, but you are encouraged to maintain forks on GitHub so that others can include your patches if they find them useful.

New Release

Two user-contributed patches have been incorporated (with minor adjustments) into ec2-consistent-snapshot with the latest release of version 0.43:

Ability to freeze multiple file systems by specifying —freeze-filesystem multiple times (thanks to Bobb Crosbie).

Ability to specify commands to run just before freezing the file system(s) and just after thawing the file systems (thanks to Craig Tracey).

The new release of ec2-consistent-snapshot is available in the Alestic PPA for easy installation and upgrading in Ubuntu. You can install it on Ubuntu using:

sudo add-apt-repository ppa:alestic &&
sudo apt-get update &&
sudo apt-get install -y ec2-consistent-snapshot

ec2-consistent-snapshot is usable on other Linux distros as long as you install dependencies like xfsprogs, perl, libnet-amazon-ec2-perl, libfile-slurp-perl, libwww-perl, libdigest-hmac-perl, libparams-validate-perl, libxml-simple-perl, libmoose-perl, libcrypt-ssleay-perl.

EBS boot vs. instance-store

If you are just getting started with Amazon EC2, then use EBS boot instances and stop reading this article. Forget that you ever heard about instance-store and accept my apology that I just mentioned it. Once you are completely comfortable with using EBS boot instances on EC2, you may (or may not) want to come back here and read why you made a good decision.

EC2 experts may find that there are specific cases, few and far between, where instance-store might make sense, but they don’t attempt to use instance-store without understanding and accounting for all the serious drawbacks and dangers that go with making this choice. For example, experts using instance-store don’t mind losing all of the data on the instance as they have designed the system so that the data is stored elsewhere and so that a new instance can easily and automatically be rebuilt from scratch.

One of the challenges for beginners is that many of the benefits of EBS boot don’t necessarily seem like something you’ll need to use right away. Then they get down the road and into situations where they realize that they would have been much better off if they had gone with EBS boot in the first place and may find it takes some work to make the transition.

Big benefits of EBS boot instances

Here are some of the reasons I use and recommend EBS boot instances. None of these benefits are available with instance-store, so even a single one of these can be an overriding factor for choosing EBS boot.

EBS boot instances store the root file system on an EBS volume which is persistent storage. If the instance hardware fails, the EBS volume remains accessible. It is also possible to request the EBS volume to persist beyond the termination of an EC2 instance. When an instance-store instance fails or is shut down, all of the data on the root disk is lost forever and can never be retrieved. Read more about protecting EC2 instances from accidental termination and loss of data.

EBS boot instances can be stopped and restarted at will. The “stopped” state suspends the hourly instance billing charges, preserving the information on the EBS volumes. The stopped instance can be started again a few minutes later or months later, restoring state just as if the instance was rebooted. An instance-store instance can only be left running with full charges or terminated, which causes you to lose all data on the disk. Read more about how stop/start of an EBS boot instance is similar to and different from a simple reboot.

When something goes wrong with an EBS boot instance so that it can’t be booted, or you lose access through ssh (e.g., lost keys, bad ssh config change), you can still view and modify or fix the EBS root volume by attaching it to another running instance. With an instance-store instance, everything on the root disk is lost and cannot be recovered. Read more about fixing files on the root EBS volume of an EC2 instance.

EBS boot instances can be run with a root EBS volume size from the default specified by the AMI (often 8GB) up to 1,000GB (1TB). The instance-store AMIs have a max root disk size of 10GB with no way to increase it. Read more about increasing the root disk size of an EBS boot AMI.

It is possible to grow the size of the root disk after an EBS boot instance has been started. An instance-store instance has no way to grow the root disk size. Read more about resizing the root disk on a running EBS boot EC2 instance.

It is possible to change the instance type for a running EBS boot instance without needing to start a new instance. For example, you can scale up from an m1.large to an m1.xlarge and then a few hours or days later, scale back down. An instance-store instance is stuck with the type on which it was originally run. Read more about changing the instance type of a running EBS boot instance.

You can easily replace the hardware for your instance if you are running an EBS boot instance. This is extremely valuable if your instance is having problems that you suspect may be related to the underlying hardware. An instance-store instance is bound to the hardware it started on and cannot be moved. Read more about using stop/start to replace EC2 hardware.

EBS boot AMIs are simpler and faster to create than instance-store AMIs. In fact, you can trigger the creation of an EBS boot AMI from a running instance in one command, API call, or console click. You need to copy sensitive AWS credentials to the instance when creating an instance-store AMI.

Amazon has stated that EBS boot AMIs boot up faster than S3 based AMIs (instance-store). In my recent experience, the difference is negligible, especially when testing popular AMIs that are likely to be cached, but we might as well chalk this up as another benefit.

The t1.micro instance type released recently by Amazon only supports EBS boot instances. This move is like a sign from Amazon that you really don’t want to run the legacy instance-store instances.

Some versions of Windows (Server 2008) only run on EBS boot instances. I believe this may be related to the disk size limitations of instance-store, but I don’t use Windows, so am not an expert in that area.

Possible benefits of instance-store instances

EBS volumes and EBS boot instances aren’t perfect. Running an instance-store instance might be preferable in some very specific cases where you don’t care so much about losing the data you are storing on the root disk.

I’m going to list some of the possible benefits of instance-store, but each of these may not be as beneficial as they appear at first glance and you must remember that running instance-store loses all of the above benefits.

There is a negigible cost savings with instance-store, as there is no charge for an EBS volume nor the I/O transactions. Note however, that the cost for an 8GB root EBS volume is only around 80 cents per month (depending on the region) and you get about a billion I/O requests for a dollar, billed by the penny increment. The cost savings to run instance-store is generally not worth the increased risk of losing your valuable data, especially when you compare it as a percentage of the cost of running the instance hours in the first place (tens or hundreds of dollars per month).

There may be some applications that perform somewhat better when running against ephemeral or instance-store disks than against EBS volumes. Some high end users have also reported inconsistency in the performance they see from EBS volumes at high I/O transaction rates for long periods of time. EBS volumes perform better for some applications and are generally good enough for most applications. If you don’t care about losing your application data, and you have tested to see that instance-store performs better than EBS volumes, then you could either run instance-store instances, or you could run EBS boot instances and drop your data on the ephemeral disks available to all instances above t1.micro. It is also becoming increasingly popular to run multiple EBS volumes in a mdadm RAID-0 or LVM striping configuration to improve performance and smooth out some experiences of performance volatility.

There are a couple historical failure modes that have happened with EBS volumes that could not happen for instance-store disks. You may hear people say this is a reason not to use EBS volumes, but EBS volumes are still far more reliable, persistent, and protected against failure than instance-store. The fact that it is possible for EBS to fail is not a reason to use the less persistent instance-store. It is a reason to create regular snapshots of your EBS volumes to improve reliability and act as backups.

If you are creating a “paid AMI” you can only do it as an instance-store AMI, not EBS boot. Only two of the thousands of people reading this article are creating paid AMIs and they already know this fact.

Why did I write this article?

I regularly provide consulting services in public communities like serverfault, the ##aws IRC channel on Freenode, the ec2ubuntu Google group, and Amazon’s EC2 forum. It’s a rare week that passes where I am not telling somebody that they would not have the problem they’re having if they had been using EBS boot instances.

The saddest response I can give to a plea for help is that the customer’s valuable data has been lost because they were running instance-store instead of EBS boot and they did not have real-time streaming backups.

Historical background

When Amazon launched EC2 in 2006, only instance-store AMIs were available (though they weren’t called instance-store at the time as they were the only kind). For years, Amazon customers learned to work with the server limitations of risking the loss of all data at any point in time.

In August of 2008, Amazon introduced the concept of EBS volumes, and there was much rejoicing. Data could finally be stored on persistent disks even though the root disk remained on ephemeral storage (another name for instance-store).

In December of 2009, Amazon released the ability to launch instances with EBS volumes as the root disk, or EBS boot instances. Now, the entire server could be persistent and all of the above benefits were realized.

Notes

Just because EBS boot volumes are “persistent” does not mean that they do not ever fail. Amazon has released figures about their failure rates, which are proportional to the number of blocks modified since the last EBS snapshot was created. Regular snapshots improve the intrinsic reliability of your EBS volumes in addition to acting as backups. I also recommend creating regular off-site backups (outside of Amazon) to eliminate your AWS account as a single point of failuire.

Even if you use an EBS boot instance, I still recommend keeping your data on a separate EBS volume. This has a number of benefits that could perhaps form the core of a followup article. Read an example of how to set up a MySQL database on a separate EBS boot volume. I still follow this approach with EBS boot instances, storing data on a second volume.

[Update 2011-01-04: Added benefit #11 (Windows Server 2008). Added note about potential (in)consistency of EBS IO at sustained, high rates.]

Retrieve Public ssh Key From EC2

| 2 Comments

A serverfault poster had a problem that I thought was a cool challenge. I had so much fun coming up with this answer, I figured I’d share it here as it demonstrates a few handy features of EC2.

Challenge

The basic need is to get the public ssh key from a keypair that exists inside of EC2. You don’t have access to the private key at the moment (but somebody else does or you will at a different location).

The AWS console and EC2 API do not let you ask for the public ssh key associated with a keypair. However, EC2 does pass the public ssh key to a new EC2 instance when you run it with a specific keypair.

The problem is that we don’t currently have the private key, so we can’t log in to the EC2 instance to get the public key. (Besides, if we did have the private key, we could extract the public key from it directly.)

Solution

I proposed creating a user-data script that sends the public ssh key to the EC2 instance console output. You can retrieve the console output without logging in to the EC2 instance.

Save the following code to a file named output-ssh-key.userdata on your local computer. DO NOT RUN THESE COMMANDS LOCALLY!

#!/bin/bash -ex
exec> >(tee /var/log/user-data.log|logger -t user -s 2>/dev/console) 2>&1
adminkey=$(GET instance-data/latest/meta-data/public-keys/ | 
  perl -ne 'print $1 if /^0=[^a-z0-9]*([-.@\w]*)/i')
cat <<EOF
SSHKEY:===================================================================
SSHKEY:HERE IS YOUR PUBLIC SSH KEY FOR KEYPAIR "$adminkey":
SSHKEY:$(cat /home/ubuntu/.ssh/authorized_keys)
SSHKEY:===================================================================
SSHKEY:Halting in 50min ($(date --date='+50 minutes' +"%Y-%m-%d %H:%M UTC"))
EOF
sleep 3000
halt

Run a stock Ubuntu 10.04 LTS instance with the above file as a user-data script. Specify the keypair for which you want to retrieve the public ssh key:

ec2-run-instances   --key YOURKEYPAIRHERE   --instance-type t1.micro   --instance-initiated-shutdown-behavior terminate   --user-data-file output-ssh-key.userdata   ami-ab36fbc2

Keep requesting the console output from the instance until it shows your public ssh key. Specify the instance id returned from the run-instances command:

ec2-get-console-output YOURINSTANCEID | grep SSHKEY: | cut -f3- -d:

Repeat the above command a couple times a minute and within 2-10 minutes you will get output like this:

===================================================================
HERE IS YOUR PUBLIC SSH KEY FOR KEYPAIR "erich":
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6rn8cl41CkzaH4ZBhczOJZaR4xBBDI1Kelc2ivzVvCB
THcdJRWpDd5I5hY5W9qke9Tm4fH3KaUVndlcP0ORGvS3PAL4lTpkS4D4goMEFrwMO8BG0NoE8sf2U/7g
aUkdcrDC7jzKYdwleRCI3uibNXiSdeG6RotClAAp7pMflDVp5WjjECDZ+8Jzs2wasdTwQYPhiWSiNcfb
fS97QdtROf0AcoPWElZAgmabaDFBlvvzcqxQRjNp/zbpkFHZBSKp+Sm4+WsRuLu6TDe9lb2Ps0xvBp1F
THlJRUVKP2yeZbVioKnOsXcjLfoJ9TEL7EMnPYinBMIE3kAYw3FzZZFeX3Q== erich
===================================================================
Halting in 50min (2011-12-20 05:58 UTC)

The temporary instance will automatically terminate itself in under an hour, but you can terminate it yourself if you’d like to make sure that you aren’t charged more than the two cents this will cost to run.

Notes

If you currently have access to the private ssh key (not true in the above challenge) you can extract the public ssh key using a command like:

ssh-keygen -y -f KEYFILE.pem


but that’s obviously not as fun.

There is no way to retrieve the private ssh key if you have lost it. To protect your security, Amazon EC2 does not store a copy of this. If you are looking to get access to an EC2 instance where you have lost the private ssh key, I recommend following the approach I wrote about in this article: http://alestic.com/2011/02/ec2-fix-ebs-root

In seemingly-related-but-not news, Scott Moser is working on an enhancement to cloud-init (used by Ubuntu on EC2, Amazon Linux, and perhaps others) so that the public ssh host keys are output to the console output on instance startup. This cool feature will allow us to add the ssh host keys to our local known_hosts files, safely avoiding that pesky “Are you sure you want to continue connecting (yes/no)?” warning.

Do you want to run short jobs on Amazon EC2 on a recurring schedule, but don’t want to pay for an instance running all the time?

Would you like to do this using standard Amazon AWS services without needing an external server to run and terminate the instance?

Amazon EC2 Auto Scaling is normally used to keep a reasonable number of instances running to handle measured or expected load (e.g., web site traffic, queue processing).

In this article I walk through the steps to create an Auto Scaling configuration that runs an instance on a recurring schedule (e.g., four times a day) starting up a pre-defined task and letting that instance shut itself down when it is finished. We tweak the Auto Scaling group so that this uses the minumum cost in instance run time, even though we may not be able to predict in advance exactly how long it will take to complete the job.

Here’s a high level overview for folks familiar with Auto Scaling:

The instance is started using a recurring schedule action that raises the min and max to 1.

The launch configuration is set to pass in a user-data script that runs the desired job on first boot. There’s no need to build our own AMI unless the software installation takes too long.

The user-data script runs shutdown at the end to move the instance to the “stopped” state, suspending hourly run charges.

Another recurring schedule action lowers the min and max to 0. This is done long after the job should have completed, just to clean up the stopped instance or to terminate an instance that perhaps failed to shut itself down. It also resets the min/max count so a new instance will be started the next time they are raised.

The missing key I found through experimentation is that we need to also suspend Auto Scaling’s (usually valid) desire to replace any unhealthy instances. If we don’t turn off this behavior, Auto Scaling will start another instance as soon as the first one shuts itself down, causing the job to be run over and over.

Prerequisites

The examples in this article assume that you have:

Installed and set up the EC2 command line tools

Installed and set up the EC2 Auto Scaling command line tools

Tell EC2 about your ssh keys using the approach described here:

Uploading Personal ssh Keys to Amazon EC2

User-data Script

The first step in setting up this process is to create a user-data script that performs the tasks you want your scheduled instance to execute each time it runs.

This user-data script can do anything you want as long as it runs this command after all the work has beeen completed:

shutdown -h now

I have created a demo user-data script for this article which you can download to your local computer now, saving it as demo-user-data-script.sh

wget -q https://raw.github.com/alestic/demo-ec2-schedule-instance/master/user-data/demo-user-data-script.sh

WARNING: Do not attempt to run this user-data script on your local computer!

Edit the downloaded demo-user-data-script.sh file and change this line at the top of the script to reflect your email address:

EMAIL=youraddress@example.com

This demo user-data script:

Upgrades the Ubuntu instance

Installs Postfix with a generic configuration so that it can send email

Sends you a demo informative message about the instance at the email address you edited in the script.

Sleeps for 5 minutes giving the email a chance to be delivered

Shuts down the EC2 instance

The first time you run this demo, try using the script as it stands, only changing your email address. Then, try adjusting the script little by little to make it do tasks that you would find more useful.

If you’d like, you can test the user-data script by itself running an instance of Ubuntu 11.10. Please update the AMI id to use the latest release:

ami_id=ami-a7f539ce # Ubuntu 11.10 Oneiric server
ec2-run-instances   --key $USER   --instance-type t1.micro   --instance-initiated-shutdown-behavior terminate   --user-data-file demo-user-data-script.sh   $ami_id

You should see an email from the instance and then it should terminate itself about 5 minutes later. Make sure you terminate it manually if it stays running after 10 minutes.

Auto Scaling Group

With the user-data script in hand, we are now ready to create the Auto Scaling setup.

Set some variables used in the commands below. Make sure you are using the latest release of the appropriate AMI.

ami_id=ami-a7f539ce # Ubuntu 11.10 Oneiric server
region=us-east-1    # Region for running the demo

zone=${region}a     # A zone in that region
export EC2_URL=https://$region.ec2.amazonaws.com
export AWS_AUTO_SCALING_URL=https://autoscaling.$region.amazonaws.com
launch_config=demo-launch-config
auto_scale_group=demo-auto-scale-group

This lauch configuration describes how we want our instance run each time including the AMI id, instance type, ssh key, and most importantly, our user-data script we edited above:

as-create-launch-config   --key $USER   --instance-type t1.micro   --user-data-file demo-user-data-script.sh   --image-id $ami_id   --launch-config "$launch_config"

The Auto Scaling group keeps track of many things including how many instances we want to have running, how they should be run (launch config above), and what instances are currently running.

as-create-auto-scaling-group   --auto-scaling-group "$auto_scale_group"   --launch-configuration "$launch_config"   --availability-zones "$zone"   --min-size 0   --max-size 0

Here’s a non-obvious but key part of this approach! Tell the Auto Scaling group that we don’t want it to restart our instance right after the instance intentionally shuts down (or fails):

as-suspend-processes   "$auto_scale_group"   --processes ReplaceUnhealthy

Now we’re finally ready to tell EC2 Auto Scaling when we want to run the instance launch configuration in the Auto Scaling group.

Here’s an example that starts one instance four times a day to run the above user-data script:

# UTC: 1:00, 7:00, 13:00, 19:00
as-put-scheduled-update-group-action   --name "demo-schedule-start"   --auto-scaling-group "$auto_scale_group"   --min-size 1   --max-size 1   --recurrence "0 01,07,13,19 * * *"

And, we need to create a matching action to make sure the instance is terminated at some point after the longest time the job could take. For this demo, we’ll trigger it 55 minutes later, but it could just as easily be 3 hours and 55 minutes later:

# UTC: 1:55, 7:55, 13:55, 19:55
as-put-scheduled-update-group-action   --name "demo-schedule-stop"   --auto-scaling-group "$auto_scale_group"   --min-size 0   --max-size 0   --recurrence "55 01,07,13,19 * * *"

The recurrence value is in a cron format using UTC.

You are welcome to change the specs in the above commands to any time you want to run the demo, especially if you don’t want to wait up to six hours for it to trigger.

Before setting new schedules, make sure you delete the existing schedule (see the next section). Don’t forget to make the stop time(s) match up appropriately with the start time(s).

Clean up

Once you’re done with this demo, you can delete the AWS resources we created by following these steps:

Delete the schedule start and stop actions:

as-delete-scheduled-action   --force   --name "demo-schedule-start"   --auto-scaling-group "$auto_scale_group"
as-delete-scheduled-action   --force   --name "demo-schedule-stop"   --auto-scaling-group "$auto_scale_group"

Scale the Auto Scaling group down to zero instances. This will terminate any running instances:

as-update-auto-scaling-group   "$auto_scale_group"   --min-size 0   --max-size 0

Delete the Auto Scaling group

as-delete-auto-scaling-group   --force-delete   --auto-scaling-group "$auto_scale_group"

Delete the Auto Scaling launch config:

as-delete-launch-config   --force   --launch-config "$launch_config"

You might now want to check to make sure nothing was left over. This works best in a wide terminal:

as-describe-launch-configs --headers
as-describe-auto-scaling-groups --headers
as-describe-scheduled-actions --headers
as-describe-auto-scaling-instances --headers

Timing

Everything takes a little time to filter through the system including:

scheduled action to raise min/max

triggering the start of an instance after a min/max is raised

starting an instance

booting an instance, installing software

running your job

shutting down an instance

scheduled action to lower min/max

triggering the termination of an instance after a min/max is lowered

When you set up the schedules, remember to make room for these things. For example, don’t schedule the termination of your instance too early or it could kill your job before it has a chance to complete.

Notes

Here are some great resources from Amazon for getting started with and learning about Auto Scaling:

The user-data script logging uses the approach described here:

Watching the output of the user-data script lets you monitor its progress as well as debug where things might be going wrong.

I haven’t run the above approach except in testing, and would welcome any pointers or improvements folks might have to offer.

Amazon just announced that the AWS MFA (multi-factor authentication) now supports virtual or software MFA devices in addition to the physical hardware MFA devices like the one that’s been taking up unwanted space in my pocket for two years.

Multi-factor authentication means that in order to log in to my AWS account using the AWS console or portal (including the AWS forums) you not only need my secret password, you also need access to a device that I carry around with me.

Before, this was a physical device attached to my key ring. Now, this is my smart phone which has the virtual (software) MFA device on it. I already carry my phone with me, so the software doesn’t take up any additional space.

To log in to AWS, I enter my password and then the current 6 digit access code displayed by the Android app on my phone. These digits change every 30 seconds in an unguessable pattern, so this enhances the security of my AWS account.

I started by using Amazon’s AWS Virtual MFA app for my Android phone, but had some complaints about it including:

You have to click on an account name to see the current digits instead of just having them shown when the app is run. There’s nothing else for the app to do but show me these digits. Just do it!

The digits disappear from the screen too fast. Sometimes I want to glance back and see if I typed them in correctly, but they’re gone and I have to click again, hoping that they haven’t changed yet.

It’s hard to choose your own account names so that you know which entry to use for different AWS accounts.

I then noticed some cryptic information in the announcements: the new feature will work with “any application that supports the open OATH TOTP standard”.

Hmmm…

Sure ‘nuff!

I already use the Google Authenticator app on my Android phone so that my Google logins can use MFA. As it turns out, Google Authenticator also works seamlessly with AWS Virtual MFA.

Google Authenticator shows the codes as soon as it is run with a little timer showing me when they will change.

Google Authenticator lets me easily edit the displayed name so that I know at a glance which code is for my personal AWS account and which one is for my company AWS account.

This also means that I only have to run one app to get access to my devices for Google accounts and for AWS accounts. Amazon may improve their Android app over time, but by using open standards users can pick whatever works best for them at the time.

I love the fact that Amazon now supports Virtual MFA. I’ve already thrown away my hardware token and my pocket feels less full.

I love the fact that Amazon implemented this as a service based on existing standards so that I can use Google’s Android app to access my account.

I love open standards.

Update: I just found this great starting page which even links to Google Authenticator as a client for Android and iPhone:

More Entries

Updated EBS boot AMIs for Ubuntu 8.04 Hardy on Amazon EC2 (2011-10-06)
Canonical has released updated instance-store AMIs for Ubuntu 8.04 LTS Hardy on Amazon EC2. Read Ben Howard’s announcement on the…
New Release of Alestic Git Server
New AMIs have been released for the Alestic Git Server. Major upgrade points include: Base operating system upgraded to Ubuntu…
Using ServerFault.com for Amazon EC2 Q&A
The Amazon EC2 Forum has been around since the beginning of EC2 and has always been a place where you…
Rebooting vs. Stop/Start of Amazon EC2 Instance
When you reboot a physical computer at your desk it is very similar to shutting down the system, and booting…
Upper Limits on Number of Amazon EC2 Instances by Region
[Update: As predicted, these numbers are already out of date and Amazon has added more public IP address ranges for…
Unavailable Availability Zones on Amazon EC2
I’m taking a class about using Chef with EC2 by Florian Drescher today and Florian mentioned that he noticed one…
Desktop AMI login security with NX
Update 2011-08-04: Amazon Security did more research and investigated the desktop AMIs. They have confirmed that their software incorrectly flagged…
Updated EBS boot AMIs for Ubuntu 8.04 Hardy on Amazon EC2
For folks still using the old, reliable Ubuntu 8.04 LTS Hardy from 2008, Canonical has released updated AMIs for use…
Creating Public AMIs Securely for EC2
Amazon published a tutorial about best practices in creating public AMIs for use on EC2 last week: How To Share…
Canonical Releases Ubuntu 11.04 Natty for Amazon EC2
As steady as clockwork, Ubuntu 11.04 Natty is released on the day scheduled at least eleven months ago; and thanks…
EC2 Reserved Instance Offering IDs Change Over Time
This article is a followup to Matching EC2 Availability Zones Across AWS Accounts written back in 2009. Please read that…
My Experience With the EC2 Judgment Day Outage
Amazon designs availability zones so that it is extremely unlikely that a single failure will take out multiple zones at…
Alestic Git Server (alpha testing)
I’m working on making it easy to start a centralized Git server with an unlimited number of private Git repositories…
Amazon EC2 Tokyo (ap-northeast-1) and Ubuntu AMIs
Amazon Web Services has launched a new EC2 region in Tokyo named ap-northeast-1. Canonical has released new AMIs in this…
Fixing Files on the Root EBS Volume of an EC2 Instance
You can examine and edit files on the root EBS volume on an EC2 instance even if you are in…
New Release of ec2-consistent-snapshot and Screencast by Ahmed Kamal
ec2-consistent-snapshot is a tool that uses the Amazon EC2 API to initiate a snapshot of an EBS volume with some…
A Simpler Way To Replace Instance Hardware on EC2
A while back I wrote an article describing a way to move the root EBS volume from one running instance…
Moving an EC2 Instance to a Larger Size
When you discover that the entry level t1.micro instance size is simply not cutting it for your growing application needs,…
Logging user-data Script Output on EC2 Instances
Real time access to user-data script output The early implementations of user-data scripts on EC2 automatically sent all output of…
Boot EC2 Instance With ssh on Port 80
In a thread on the EC2 forum, Marko describes a situation where an outbound firewall prevents the ability to ssh…


You are viewing a mobilized version of this site...
View original page here

Mobilized by Mowser Mowser