AWS AWSEC2 documentation change
Summary
Updated documentation about AMI boot mode inheritance, added detailed conversion steps between BIOS/UEFI, restructured warnings into considerations section, and updated CLI/PowerShell examples
Security assessment
The changes clarify requirements for UEFI Secure Boot compatibility and warn about misconfiguration risks, but do not address a specific disclosed vulnerability. Security documentation is added through explanations of UEFI-dependent features like Secure Boot and configuration requirements to maintain security capabilities.
Diff
diff --git a/AWSEC2/latest/UserGuide/set-ami-boot-mode.md b/AWSEC2/latest/UserGuide/set-ami-boot-mode.md index ad2ea3b22..9f0a02f29 100644 --- a//AWSEC2/latest/UserGuide/set-ami-boot-mode.md +++ b//AWSEC2/latest/UserGuide/set-ami-boot-mode.md @@ -7 +7,3 @@ -When you create an AMI using the [register-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/register-image.html) command, you can set the boot mode of the AMI to either `uefi`, `legacy-bios`, or `uefi-preferred`. +By default, an AMI inherits the boot mode of the EC2 instance used to create the AMI. For example, if you create an AMI from an EC2 instance running on Legacy BIOS, the boot mode of the new AMI is `legacy-bios`. If you create an AMI from an EC2 instance with a boot mode of `uefi-preferred`, the boot mode of the new AMI is `uefi-preferred`. + +When you register an AMI, you can set the boot mode of the AMI to `uefi`, `legacy-bios`, or `uefi-preferred`. @@ -18,2 +19,0 @@ When the AMI boot mode is set to `uefi-preferred`, the instance boots as follows -###### Note - @@ -22 +22 @@ If you set the AMI boot mode to `uefi-preferred`, the operating system must supp -Currently, you can't use the [register-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/register-image.html) command to create an AMI that supports both [NitroTPM](./nitrotpm.html) and UEFI Preferred. +To convert an existing Legacy BIOS-based instance to UEFI, or an existing UEFI-based instance to Legacy BIOS, you must first modify the instance's volume and operating system to support the selected boot mode. Then, create a snapshot of the volume. Finally, create an AMI from the snapshot. @@ -24 +24 @@ Currently, you can't use the [register-image](https://awscli.amazonaws.com/v2/do -###### Warning +###### Considerations @@ -26 +26 @@ Currently, you can't use the [register-image](https://awscli.amazonaws.com/v2/do -Some features, like UEFI Secure Boot, are only available on instances that boot on UEFI. When you use the `uefi-preferred` AMI boot mode parameter with an instance type that does not support UEFI, the instance will launch as Legacy BIOS and the UEFI-dependent feature will be disabled. If you rely on the availability of a UEFI-dependent feature, set your AMI boot mode parameter to `uefi`. + * Setting the AMI boot mode parameter does not automatically configure the operating system for the specified boot mode. You must first make suitable modifications to the instance's volume and operating system to support booting using the selected boot mode. Otherwise, the resulting AMI is not usable. For example, if you are converting a Legacy BIOS-based Windows instance to UEFI, you can use the [MBR2GPT](https://learn.microsoft.com/en-us/windows/deployment/mbr-to-gpt) tool from Microsoft to convert the system disk from MBR to GPT. The modifications that are required are operating system-specific. For more information, see the manual for your operating system. @@ -28 +28 @@ Some features, like UEFI Secure Boot, are only available on instances that boot -To convert an existing Legacy BIOS-based instance to UEFI, or an existing UEFI-based instance to Legacy BIOS, you need to perform a number of steps: First, modify the instance's volume and operating system to support the selected boot mode. Then, create a snapshot of the volume. Finally, use [register-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/register-image.html) to create the AMI using the snapshot. + * You can't use the [register-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/register-image.html) command or the [Register-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Register-EC2Image.html) cmdlet to create an AMI that supports both [NitroTPM](./nitrotpm.html) and UEFI Preferred. @@ -30 +30 @@ To convert an existing Legacy BIOS-based instance to UEFI, or an existing UEFI-b -You can't set the boot mode of an AMI using the [create-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-image.html) command. With [create-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-image.html), the AMI inherits the boot mode of the EC2 instance used for creating the AMI. For example, if you create an AMI from an EC2 instance running on Legacy BIOS, the AMI boot mode will be configured as `legacy-bios`. If you create an AMI from an EC2 instance that was launched using an AMI with a boot mode set to `uefi-preferred`, the AMI that is created will also have its boot mode set to `uefi-preferred`. + * Some features, like UEFI Secure Boot, are only available on instances that boot on UEFI. When you use the `uefi-preferred` AMI boot mode parameter with an instance type that does not support UEFI, the instance launches as Legacy BIOS and the UEFI-dependent feature is disabled. If you rely on the availability of a UEFI-dependent feature, set your AMI boot mode parameter to `uefi`. @@ -32 +31,0 @@ You can't set the boot mode of an AMI using the [create-image](https://awscli.am -###### Warning @@ -34 +32,0 @@ You can't set the boot mode of an AMI using the [create-image](https://awscli.am -Setting the AMI boot mode parameter does not automatically configure the operating system for the specified boot mode. Before proceeding with these steps, you must first make suitable modifications to the instance's volume and operating system to support booting using the selected boot mode; otherwise, the resulting AMI will not be usable. For example, if you are converting a Legacy BIOS-based Windows instance to UEFI, you can use the [MBR2GPT](https://learn.microsoft.com/en-us/windows/deployment/mbr-to-gpt) tool from Microsoft to convert the system disk from MBR to GPT. The modifications that are required are operating system-specific. For more information, see the manual for your operating system. @@ -36 +34,5 @@ Setting the AMI boot mode parameter does not automatically configure the operati -###### To set the boot mode of an AMI (AWS CLI) + +AWS CLI + + +###### To set the boot mode of an AMI @@ -40 +42 @@ Setting the AMI boot mode parameter does not automatically configure the operati -###### Note +###### Warning @@ -69,2 +71,2 @@ The following is example output. - --volume-id vol-1234567890abcdef0 \ - --description "add text" + --volume-id vol-01234567890abcdef \ + --description "my snapshot" @@ -75 +77 @@ The following is example output. - "Description": "add text", + "Description": "my snapshot", @@ -77 +79 @@ The following is example output. - "OwnerId": "123", + "OwnerId": "123456789012", @@ -79 +81 @@ The following is example output. - "SnapshotId": "snap-01234567890abcdef", + "SnapshotId": "snap-0abcdef1234567890", @@ -82 +84 @@ The following is example output. - "VolumeId": "vol-1234567890abcdef0", + "VolumeId": "vol-01234567890abcdef", @@ -87,3 +89 @@ The following is example output. - 4. Note the snapshot ID in the output from the previous step. - - 5. Wait until the snapshot creation is `completed` before going to the next step. To query the state of the snapshot, use the [describe-snapshots](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-snapshots.html) command. + 4. Wait until the state of the snapshot is `completed` before you go to the next step. To get the state of the snapshot, use the [describe-snapshots](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-snapshots.html) command with the snapshot ID from the previous step. @@ -91 +91,4 @@ The following is example output. - aws ec2 describe-snapshots --region us-east-1 --snapshot-ids snap-01234567890abcdef + aws ec2 describe-snapshots \ + --snapshot-ids snap-0abcdef1234567890 \ + --query Snapshots[].State \ + --output text @@ -93 +96 @@ The following is example output. -Example output +The following is example output. @@ -95,13 +98 @@ Example output - { - "Snapshots": [ - { - "Description": "This is my snapshot", - "Encrypted": false, - "VolumeId": "vol-049df61146c4d7901", - **"State": "completed",** - "VolumeSize": 8, - "StartTime": "2019-02-28T21:28:32.000Z", - "Progress": "100%", - "OwnerId": "012345678910", - "SnapshotId": "snap-01234567890abcdef", - ... + completed @@ -109 +100 @@ Example output - 6. To create a new AMI, use the [register-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/register-image.html) command. Use the snapshot ID that you noted in the earlier step. + 5. To create a new AMI, use the [register-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/register-image.html) command. Use the value of `SnapshotId` from the output of **CreateSnapshot**. @@ -111 +102 @@ Example output - * To set the boot mode to UEFI, add the `--boot-mode` parameter to the command and specify `uefi` as the value. + * To set the boot mode to UEFI, add the `--boot-mode` parameter with a value of `uefi`. @@ -114,5 +105,3 @@ Example output - --region us-east-1 \ - --description "add description" \ - --name "add name" \ - --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=snap-01234567890abcdef,DeleteOnTermination=true}" \ - --architecture x86_64 \ + --description "my image" \ + --name "my-image" \ + --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=snap-0abcdef1234567890,DeleteOnTermination=true}" \ @@ -124 +113 @@ Example output - * To set the boot mode to `uefi-preferred`, add the `--boot-mode` parameter to the command and specify `uefi-preferred` as the value. + * To set the boot mode to `uefi-preferred`, set the value of `--boot-mode` to `uefi-preferred` @@ -127,5 +116,3 @@ Example output - --region us-east-1 \ - --description "add description" \ - --name "add name" \ - --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=snap-01234567890abcdef,DeleteOnTermination=true}" \ - --architecture x86_64 \ + --description "my description" \ + --name "my-image" \ + --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=snap-0abcdef1234567890,DeleteOnTermination=true}" \ @@ -137 +124 @@ Example output -Expected output + 6. (Optional) To verify that the newly-created AMI has the boot mode that you specified, use the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command. @@ -139,3 +126,4 @@ Expected output - { - "ImageId": "ami-new_ami_123" - } + aws ec2 describe-images \ + --image-id ami-1234567890abcdef0 \ + --query Images[].BootMode \ + --output text @@ -143 +131 @@ Expected output - 7. To verify that the newly-created AMI has the boot mode that you specified in the previous step, use the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command. +The following is example output. @@ -145 +133 @@ Expected output - aws ec2 describe-images --region us-east-1 --image-id ami-new_ami_123 + uefi @@ -148 +135,0 @@ Expected output -Expected output @@ -150,12 +136,0 @@ Expected output - { - "Images": [ - { - "Architecture": "x86_64", - "CreationDate": "2021-01-06T14:31:04.000Z", - "ImageId": "ami-new_ami_123", - "ImageLocation": "", - ... - **"BootMode": "uefi"** - } - ] - } @@ -163 +138,32 @@ Expected output - 8. Launch a new instance using the newly-created AMI. +PowerShell + + +###### To set the boot mode of an AMI + + 1. Make suitable modifications to the instance's volume and operating system to support booting via the selected boot mode. The modifications that are required are operating system-specific. For more information, see the manual for your operating system. + +###### Warning + +If you don't perform this step, the AMI will not be usable. + + 2. To find the volume ID of the instance, use the [Get-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Instance.html) cmdlet. + + (Get-EC2Instance ` + -InstanceId i-1234567890abcdef0).Instances.BlockDeviceMappings.Ebs + +The following is example output. + + AssociatedResource : + AttachTime : 7/11/2024 1:05:51 AM + DeleteOnTermination : True + Operator : + Status : attached + VolumeId : vol-01234567890abcdef + + 3. To create a snapshot of the volume, use the [New-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Snapshot.html) cmdlet. Use the volume ID from the previous step. + + New-EC2Snapshot ` + -VolumeId vol-01234567890abcdef ` + -Description "my snapshot" + +The following is example output. @@ -165 +171,54 @@ Expected output -If the AMI boot mode is `uefi` or `legacy-bios`, instances created from this AMI will have the same boot mode as the AMI. If the AMI boot mode is `uefi-preferred`, the instance will boot using UEFI if the instance type supports UEFI; otherwise, the instance will boot using Legacy BIOS. + AvailabilityZone : + Description : my snapshot + Encrypted : False + FullSnapshotSizeInBytes : 0 + KmsKeyId : + OwnerId : 123456789012 + RestoreExpiryTime : + SnapshotId : snap-0abcdef1234567890 + SseType : + StartTime : 4/25/2025 6:08:59 PM + State : pending + StateMessage : + VolumeId : vol-01234567890abcdef + VolumeSize : 30 + + 4. Wait until the state of the snapshot is `completed` before you go to the next step. To get the state of the snapshot, use the [Get-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Snapshot.html) cmdlet with the snapshot ID from the previous step. + + (Get-EC2Snapshot `