AWS AWSEC2 documentation change
Summary
Updated NTP configuration documentation with clearer instructions, added troubleshooting links, and restructured content for better readability. Changes include updating section headers, adding verification steps, and simplifying command outputs.
Security assessment
The changes are primarily focused on improving documentation clarity and structure, with no mention of security vulnerabilities or new security features. The updates include better organization of content and more precise instructions for NTP configuration.
Diff
diff --git a/AWSEC2/latest/UserGuide/configure-ec2-ntp.md index 66792a932..b2621f1b0 100644 --- a/AWSEC2/latest/UserGuide/configure-ec2-ntp.md +++ b/AWSEC2/latest/UserGuide/configure-ec2-ntp.md @@ -30 +30 @@ NTP and PTP connections do not require any VPC configuration changes, and your i -###### Note +###### Considerations @@ -39 +39 @@ NTP and PTP connections do not require any VPC configuration changes, and your i -###### Topics +###### Contents @@ -52 +52,3 @@ NTP and PTP connections do not require any VPC configuration changes, and your i -This section describes how to configure your instance to use the local Amazon Time Sync Service through the IPv4 endpoint. +Your AMI might already have configured the Amazon Time Sync Service by default. Otherwise, use the following procedures to configure your instance to use the local Amazon Time Sync Service through the IPv4 endpoint. + +For help troubleshooting issues, see [Troubleshoot NTP synchronization issues on Linux instances](https://repost.aws/knowledge-center/linux-troubleshoot-ntp-synchronization) or [Troubleshoot time issues on Windows instances](https://repost.aws/knowledge-center/ec2-windows-time-service). @@ -54 +56 @@ This section describes how to configure your instance to use the local Amazon Ti -Use the instructions for your instance's operating system. +Amazon Linux @@ -56 +57,0 @@ Use the instructions for your instance's operating system. -AL2023 and the latest versions of Amazon Linux 2 are configured to use the Amazon Time Sync Service IPv4 endpoint by default. No further configuration is required for instances launched from these AMIs and you can skip the following procedure. @@ -58 +59 @@ AL2023 and the latest versions of Amazon Linux 2 are configured to use the Amazo -If you're using an AMI that doesn't have the Amazon Time Sync Service configured by default, use one of the following procedures to configure the Amazon Time Sync Service on your instance using the `chrony` client. It requires adding a server entry for the Amazon Time Sync Service to the `chrony` configuration file. +AL2023 and recent versions of Amazon Linux 2 are configured to use the Amazon Time Sync Service IPv4 endpoint by default. If you confirm that your instance is already configured, you can skip the following procedure. @@ -60 +61 @@ If you're using an AMI that doesn't have the Amazon Time Sync Service configured -Use the instructions for your instance's operating system. +###### To verify that chrony is configured to use the IPv4 endpoint @@ -62 +63 @@ Use the instructions for your instance's operating system. -Amazon Linux +Run the following command. In the output, the line that starts with `^*` indicates the preferred time source. @@ -65 +66,4 @@ Amazon Linux -###### To connect to the IPv4 endpoint of the Amazon Time Sync Service on Amazon Linux using chrony + chronyc sources -v | grep -F ^* + ^* 169.254.169.123 3 4 377 14 +12us[+9653ns] +/- 290us + +###### To configure chrony to connect to the IPv4 endpoint on older versions of Amazon Linux 2 @@ -95 +99 @@ On RHEL and CentOS (up to version 6), the service name is `chrony` instead of `c - [ec2-user ~]$ chronyc sources -v + [ec2-user ~]$ chronyc sources -v | grep -F ^* @@ -97,19 +101 @@ On RHEL and CentOS (up to version 6), the service name is `chrony` instead of `c - 210 Number of sources = 7 - - .-- Source mode '^' = server, '=' = peer, '#' = local clock. - / .- Source state '*' = current synced, '+' = combined , '-' = not combined, - | / '?' = unreachable, 'x' = time may be in error, '~' = time too variable. - || .- xxxx [ yyyy ] +/- zzzz - || Reachability register (octal) -. | xxxx = adjusted offset, - || Log2(Polling interval) --. | | yyyy = measured offset, - || \ | | zzzz = estimated error. - || | | \ - MS Name/IP address Stratum Poll Reach LastRx Last sample - =============================================================================== - ^* 169.254.169.123 3 6 17 43 -30us[ -226us] +/- 287us - ^- ec2-12-34-231-12.eu-west> 2 6 17 43 -388us[ -388us] +/- 11ms - ^- tshirt.heanet.ie 1 6 17 44 +178us[ +25us] +/- 1959us - ^? tbag.heanet.ie 0 6 0 - +0ns[ +0ns] +/- 0ns - ^? bray.walcz.net 0 6 0 - +0ns[ +0ns] +/- 0ns - ^? 2a05:d018:c43:e312:ce77:> 0 6 0 - +0ns[ +0ns] +/- 0ns - ^? 2a05:d018:dab:2701:b70:b> 0 6 0 - +0ns[ +0ns] +/- 0ns +In the output, `^*` indicates the preferred time source. @@ -117 +103 @@ On RHEL and CentOS (up to version 6), the service name is `chrony` instead of `c -In the output that's returned, `^*` indicates the preferred time source. + ^* 169.254.169.123 3 6 17 43 -30us[ -226us] +/- 287us @@ -143 +129 @@ Ubuntu -###### To connect to the IPv4 endpoint of the Amazon Time Sync Service on Ubuntu using chrony +###### To configure chrony to connect to the IPv4 endpoint on Ubuntu @@ -165 +151 @@ If necessary, update your instance first by running `sudo apt update`. - ubuntu:~$ chronyc sources -v + ubuntu:~$ chronyc sources -v | grep -F ^* @@ -167 +153 @@ If necessary, update your instance first by running `sudo apt update`. - 210 Number of sources = 7 +In the output, the line starting with `^*` indicates the preferred time source. @@ -169,10 +154,0 @@ If necessary, update your instance first by running `sudo apt update`. - .-- Source mode '^' = server, '=' = peer, '#' = local clock. - / .- Source state '*' = current synced, '+' = combined , '-' = not combined, - | / '?' = unreachable, 'x' = time may be in error, '~' = time too variable. - || .- xxxx [ yyyy ] +/- zzzz - || Reachability register (octal) -. | xxxx = adjusted offset, - || Log2(Polling interval) --. | | yyyy = measured offset, - || \ | | zzzz = estimated error. - || | | \ - MS Name/IP address Stratum Poll Reach LastRx Last sample - =============================================================================== @@ -180,8 +155,0 @@ If necessary, update your instance first by running `sudo apt update`. - ^- tbag.heanet.ie 1 6 17 13 -3488us[-3446us] +/- 1779us - ^- ec2-12-34-231-12.eu-west- 2 6 17 13 +893us[ +935us] +/- 7710us - ^? 2a05:d018:c43:e312:ce77:6 0 6 0 10y +0ns[ +0ns] +/- 0ns - ^? 2a05:d018:d34:9000:d8c6:5 0 6 0 10y +0ns[ +0ns] +/- 0ns - ^? tshirt.heanet.ie 0 6 0 10y +0ns[ +0ns] +/- 0ns - ^? bray.walcz.net 0 6 0 10y +0ns[ +0ns] +/- 0ns - -In the output that's returned, on the line starting with `^*` indicates the preferred time source. @@ -215 +183 @@ Starting with SUSE Linux Enterprise Server 15, `chrony` is the default implement -###### To connect to IPv4 endpoint of the Amazon Time Sync Service on SUSE Linux using chrony +###### To configure chrony to connect to IPv4 endpoint on SUSE Linux @@ -231,0 +200,3 @@ If this line is not present, add it. +Windows + + @@ -302,2 +272,0 @@ The IPv6 endpoint is only accessible on [Nitro-based instances](./instance-types -###### Note - @@ -306 +275,2 @@ We don't recommend using both the IPv4 and IPv6 endpoint entries together. The I -Use the instructions for your instance's operating system. +Linux + @@ -319,0 +290,3 @@ In the output, if you see the `fd00:ec2::123` IPv6 endpoint, the configuration i +Windows + +