AWS license-manager documentation change
Summary
Added multiple new troubleshooting sections for user subscription products covering network configurations, directory service integration, security group requirements, and compliance controls
Security assessment
The changes document security-related configurations including security group requirements for domain controllers, SSM access controls, VPC endpoint management, and restrictions on local administrator accounts. While these enhance security documentation, there is no evidence they address specific disclosed vulnerabilities.
Diff
diff --git a/license-manager/latest/userguide/troubleshooting.md b/license-manager/latest/userguide/troubleshooting.md index 3f67ec36e..104876308 100644 --- a//license-manager/latest/userguide/troubleshooting.md +++ b//license-manager/latest/userguide/troubleshooting.md @@ -5 +5 @@ -Cross-account discovery errorManagement account cannot disassociate resources from a self-managed licenseSystems Manager Inventory is out of dateApparent persistence of a de-registered AMINew child account instances are slow to appear in resource inventoryAfter enabling cross-account mode, child account instances are slow to appearCross-account discovery cannot be disabledChild account user cannot associate shared self-managed license with an instanceLinking AWS Organizations accounts fails +Cross-account discovery errorManagement account cannot disassociate resources from a self-managed licenseSystems Manager Inventory is out of dateApparent persistence of a de-registered AMINew child account instances are slow to appear in resource inventoryAfter enabling cross-account mode, child account instances are slow to appearCross-account discovery cannot be disabledChild account user cannot associate shared self-managed license with an instanceLinking AWS Organizations accounts failsUser subscription product configuration failingUser subscription instances failing to launchSeamless domain join for EC2 instances with user subscription products doesn't workUnable to delete active directoryVPC endpoint was created in my accountRemove all VPC endpoint resources created by License ManagerUnable to delete AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService Service Linked Role (SLR)Subscription is not present error for RDS SAL productTroubleshooting trustsBilling issues for user subscriptionsUser subscription products show Marketplace subscription status of InactiveChange a username on Managed Active DirectoryDissociate users from a terminated instanceUser limits per instanceInstalling additional software on user subscription instancesJapanese Language Packs on user subscription instancesLocal Administrator user on user subscription instancesUnhealthy instancesNumber of users that can RDP to a user subscriptions instanceSupported Windows operating systemsSupported versions of Office and Visual StudioUsing user subscription with older Windows Server versionsUsing License Manager user subscriptions across accounts or regionsUsers in my self-managed AD with User subscription productsTips for contacting AWS Support @@ -68,0 +69,223 @@ If the **Settings** page reports this error, it means that an account is not a m +## User subscription product configuration failing + +Your product configuration may be failing due to issues with outbound network access. To address this, ensure that the default security group permits outbound traffic to the IPv4 addresses of each domain controller's network interface as well as SSM. + + * Verify that default security group settings facilitate outbound traffic to the IPv4 addresses of domain controller network interfaces. + + * License Manager creates two network interfaces which use the default security group of the VPC where your AWS Managed Microsoft AD is provisioned. These interfaces are used for required service functionality with your directory. Ensure that your default security group allows outbound traffic to each domain controller's network interface IPv4 address, or the security group used by the domain controllers. For more information, see [Prerequisites to create user-based subscriptions](user-based-subscriptions.html#usubs-prerequisites) and [What gets created](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_what_gets_created.html) in the AWS Directory Service Administration Guide. + + * Configure outbound internet access from instances providing user-based subscriptions or VPC endpoints. + + * Outbound internet access from the instances providing user-based subscriptions, or VPC endpoints, must be configured for your instances to communicate with SSM. For more information, see [Setting up Systems Manager for EC2 instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-ec2.html) in the AWS Systems Manager User Guide. + + + + +Once the provisioning process is complete, you can associate a different security group to the interfaces created by License Manager. The security group you select must also allow the required traffic to each domain controller's network interface IPv4 address or security group. For more information, see [Work with security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) in the Amazon Virtual Private Cloud User Guide. + +## User subscription instances failing to launch + +Your instance launches can be failing due to multiple reasons. Here are some of the common issues for which an instance launch may fail: + + * Ensure your instance is discoverable by SSM, see [Troubleshoot instance connectivity](./user-based-subscriptions-troubleshoot.html#user-based-subscriptions-troubleshoot-instance-connectivity). + + * Ensure your instance is able to join your domain, see [Troubleshoot failures to join the domain](./user-based-subscriptions-troubleshoot.html#user-based-subscriptions-troubleshoot-domain-join). + + * Ensure that the Route53 outbound resolver endpoint rule is set. For more information, see the blog post [Integrating your Directory Service's DNS resolution with Amazon Route 53 Resolvers](https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-your-directory-services-dns-resolution-with-amazon-route-53-resolvers/). + + * If launching instances from custom AMIs created on top of User subscription AMIs, please make sure to perform Sysprep and ensure unique computer names when creating and launching instances from custom AMIs. + + + + +## Seamless domain join for EC2 instances with user subscription products doesn't work + +License Manager needs to perform domain join on these instances using SSM to allow authorized access to only users subscribed to the product. As a result, the seamless domain join feature is deactivated. + +## Unable to delete active directory + +License Manager is registered as an authorized application with Directory Service during configuration, thereby safeguarding active directories from deletion once configured. As part of the standard procedure, customers need to first remove all instances, instance associations, and user subscriptions. Following this, they can proceed with removing the active directory from the License Manager and subsequently delete the directory itself. + +## VPC endpoint was created in my account + +License Manager creates VPC endpoints required for your resources to connect to activation servers and remain in compliance when you configure your VPC. + +## Remove all VPC endpoint resources created by License Manager + +In order to delete the VPC endpoint resources, you must perform the following actions: + + * Disassociate all users from their user-based subscriptions. For more information, see [Disassociate users from an instance that provides License Manager user-based subscriptions](./usubs-disassociate-users.html). + + * Remove any directory that is configured from the License Manager settings. For more information, see [Deregister an Active Directory from License Manager settings](./usubs-deregister-ad.html). + + * Terminate all instances providing user-based subscription products. For more information, see [Launch an instance from a license included AMI](./usubs-launch-instance.html). + + + + +## Unable to delete AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService Service Linked Role (SLR) + +License Manager requires the "AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService" service-linked role for managing AWS resources that will provide user-based subscriptions. A service-linked role makes setting up License Manager easier because you don't have to manually add the necessary permissions. License Manager defines the permissions of its service-linked roles, and unless defined otherwise, only License Manager can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. + +For more information, see [Prerequisites to create user-based subscriptions in License Manager](./user-based-subscriptions.html#usubs-prerequisites) and [License Manager – User-based subscription role](https://docs.aws.amazon.com/license-manager/latest/userguide/user-based-subscription-role.html) and [Service-linked roles](https://docs.aws.amazon.com/singlesignon/latest/userguide/slrconcept.html). + +## _Subscription is not present_ error for RDS SAL product + +Your account must have a subscription to Windows Server Remote Desktop Services Subscriber Access License (RDS SAL). All users associated with instances providing user-based subscription products must have a single active subscription to this license in addition to any other products they would like to use. Your user will be subscribed to RDS SAL on their behalf when they subscribe to a user-based subscription product. + +But if this has been unsubscribed or removed due to other compliance reasons, you might have to resubscribe. If you are already subscribed, you can try unsubscribing and resubscribing, which will not affect your License Manager user subscriptions. + +## Troubleshooting trusts + +Based on our experience working with many customers, the vast majority of trust configuration issues are either DNS resolution or networking connectivity errors. These are some troubleshooting steps to help you resolve common issues: + + * Check whether you allowed outbound networking traffic on the AWS Managed Microsoft AD. + + * If the DNS server or the network for your on-premises domain uses a public (non-RFC 1918) IP address space, follow these steps: + + * In the AWS Directory Service console, go to the IP routing section for your directory, choose **Actions** , and then choose **Add route**. + + * Enter the IP address block of your DNS server or on-premises network using CIDR format, for example 203.0.113.0/24. + + * This step isn't necessary if both your DNS server and your on-premises network are using RFC 1918 private IP address spaces. + + * After you verify the security group and check whether any applicable routes are required, launch a Windows Server instance and join it to the AWS Managed Microsoft AD directory. Once the instance is launched: + + * Run this PowerShell command to test DNS connectivity: + + Resolve-DnsName -Name 'example.local' -DnsOnly + + + + +You should also look through the message explanations in the [Trust creation status reasons guide](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_troubleshooting_trust_creation.html) in the AWS Directory Service documentation. + +## Billing issues for user subscriptions + +AWS will bill you through a monthly subscription, based on the number of users associated with the license included Microsoft Office or Visual Studio instances. These per-user charges are billed per calendar month, and the billing starts from the time you subscribe to the product. If you remove access to a user during the existing month, you will be billed for the user for the remainder of the month. You will stop incurring charges for the user the following month. + +Furthermore: + + * Billing is based on a per-user basis within User subscriptions. Only users who are subscribed to the product will incur charges, not all users in the active directory. + + * Billing operates on a monthly cycle, starting from the first day of each calendar month. Charges are levied for the entire month, regardless of the specific date of subscription activation. + + * You need an RDS SAL for each user who needs to access your Office/VS instances. + + * To stop incurring charges for user-based subscriptions, you must disassociate the user from all instances they are associated with. Deleting a user from Active Directory does not disassociate the user from instances. For more information, see [Disassociate users from an instance that provides License Manager user-based subscriptions](./usubs-disassociate-users.html). + + * A user is only counted once. You get charged per user for Microsoft Office and Visual Studio, irrespective of the number of EC2 instances the user connects to. Users are charged for their subscription once, regardless of their usage of multiple instances. + + + + +## User subscription products show Marketplace subscription status of Inactive + +After you configure your directory with the required products, you would need to subscribe to the required products. Products with a Marketplace Subscription Status of Inactive require you to subscribe before you can associate users to an instance and utilize them. + +## Change a username on Managed Active Directory + +Changing a username has no effect on their ability to RDP into associated instances. The associated users should be able to use their updated login details to RDP into user subscription instances. + +## Dissociate users from a terminated instance + +Whenever a user subscriptions instance is terminated, all the users that are associated to the instance are disassociated. You do not have to manually disassociate the user. + +###### Note + +Users are not dissociated if the instance is stopped. + +## User limits per instance + +There is a limit of 25 instances per user. In case you need adjustment, please reach out to AWS Support. Users are charged for their subscription once, regardless of their usage of multiple instances. + +## Installing additional software on user subscription instances + +You can install additional software on your instances that aren't available as user-based subscriptions. Additional software installations aren't tracked by License Manager. These installations must be performed using the Admin account which is created by default in your AWS Managed Microsoft AD directory. For more information, see [Admin account](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.html) in the AWS Directory Service Administration Guide. + +To install additional software with the Admin account, you must: + + * Subscribe the Admin account to the product provided by the instance. + + * Associate the Admin account to the instance. + + * Connect to the instance using the Admin account to perform the installation. + + + + +For more information, see [Get started with user-based subscriptions in License Manager](./user-based-subscriptions-getting-started.html). + +## Japanese Language Packs on user subscription instances + +Japanese language pack installation is supported with User subscription instances. + +## Local Administrator user on user subscription instances + +We only allow users under the users managed active directory domain to be associated with user subscription instances to prevent unauthorized access to these Microsoft products. When you create local users with administrator privileges on instances that provide user-based subscriptions, the instance's health status changes to unhealthy. + +## Unhealthy instances + +Instances providing user-based subscriptions must remain in a healthy status to be in compliance. Instances that are marked as unhealthy no longer meet the required prerequisites. License Manager attempts to return the instance to a healthy status, but instances that are not able to return to a healthy status are terminated. + +## Number of users that can RDP to a user subscriptions instance + +Instances that provide user-based subscriptions support up to two active user sessions at a time as stated in [Use License Manager user-based subscriptions for supported software products](https://docs.aws.amazon.com/license-manager/latest/userguide/user-based-subscriptions.html). By default, Windows allows up to 2 Remote Desktop connections including an Admin connection at any given time, in all editions of Windows server. For using more than 2 concurrent users, customers need to setup an RDS Licensing server. + +## Supported Windows operating systems + +For information about supported Windows operating system platforms, see [Supported software products for user-based subscriptions in License Manager](./user-based-subscriptions.html#usubs-software). + +## Supported versions of Office and Visual Studio + +For information about supported software for user-based subscriptions, see [Supported software for user-based subscriptions](./user-based-subscriptions.html#usubs-software-supported). + +## Using user subscription with older Windows Server versions + +When you launch an instance from an AMI that supports Office LTSC Professional Plus or Microsoft Visual Studio, the launch defaults to the latest Windows OS platform version of the AMI (for example Windows Server 2022). To launch with an earlier OS platform version, follow these steps: + + 1. Open the AWS Marketplace console at [https://console.aws.amazon.com/marketplace](https://console.aws.amazon.com/marketplace). + + 2. Choose **Manage subscriptions** from the navigation pane. + + 3. To streamline subscription results, you can search for all or part of the subscription name. For example, Office LTSC Professional Plus 2021 or Visual Studio Enterprise. + + 4. Select **Launch new instance** from the subscription panel. This opens a launch configuration page. + + 5. To launch an instance from an AMI that's based on an earlier version of the Windows OS platform, select the full AWS Marketplace website link, located under the Software version. This takes you to a configuration page where you can select from a list of versions. + + 6. The list shows the latest AMI versions for the supported Windows OS platforms. Select the Windows OS version that you want to launch from. + + +