AWS vm-import documentation change
Summary
Restructured examples, added PowerShell commands, clarified encryption requirements, and updated references. Added detailed steps for using encrypted volumes with KMS keys.
Security assessment
The changes include documentation enhancements for encryption during VM imports (--encrypted flag, KMS key usage, and CMK availability requirements). While this improves security documentation, there is no evidence it addresses a specific vulnerability. The encryption guidance helps users implement security best practices.
Diff
diff --git a/vm-import/latest/userguide/import-vm-image.md b/vm-import/latest/userguide/import-vm-image.md index 6f4152d2c..b7604c643 100644 --- a//vm-import/latest/userguide/import-vm-image.md +++ b//vm-import/latest/userguide/import-vm-image.md @@ -9 +9 @@ PrerequisitesUpload the image to Amazon S3Import the VM -After exporting your VM from your virtualization environment, you can import it to Amazon EC2. The import process is the same regardless of the origin of the VM. +After exporting your VM from your virtualization environment, you can import it to Amazon EC2 using VM Import/Export. The import process is the same regardless of the origin of the VM. @@ -45 +45 @@ After you upload your VM image file to Amazon S3, you can use the AWS CLI to imp -You can also use the _Import virtual machine images to AWS template_ in the [Migration Hub Orchestrator](https://console.aws.amazon.com/migrationhub/orchestrator/) console to import your on-premises virtual machine images to AWS. For more information, see Example 4. +You can also use the _Import virtual machine images to AWS template_ in the [Migration Hub Orchestrator](https://console.aws.amazon.com/migrationhub/orchestrator/) console to import your on-premises virtual machine images to AWS. For more information, see Example 4: Import an image using Migration Hub Orchestrator. @@ -53 +52,0 @@ You can also use the _Import virtual machine images to AWS template_ in the [Mig - * If you use a JSON file to pass input to the `disk-containers` parameter, prefix the file path with `file://` or a syntax related error might occur. @@ -56,0 +56 @@ You can also use the _Import virtual machine images to AWS template_ in the [Mig +###### Examples @@ -58 +58 @@ You can also use the _Import virtual machine images to AWS template_ in the [Mig -The following examples use the AWS CLI command [import-image](https://docs.aws.amazon.com/cli/latest/reference/ec2/import-image.html) to create import tasks. + * Example 1: Import an image using an OVA file @@ -60 +60 @@ The following examples use the AWS CLI command [import-image](https://docs.aws.a -**Example 1: Import an image with a single disk** + * Example 2: Import an image with multiple disks @@ -62 +62 @@ The following examples use the AWS CLI command [import-image](https://docs.aws.a -Use the following command to import an image with a single disk. + * Example 3: Import with the encrypted option enabled @@ -63,0 +64 @@ Use the following command to import an image with a single disk. + * Example 4: Import an image using Migration Hub Orchestrator @@ -65 +65,0 @@ Use the following command to import an image with a single disk. - aws ec2 import-image --description "My server VM" --disk-containers "file://C:\import\containers.json" @@ -67 +66,0 @@ Use the following command to import an image with a single disk. -The following is an example `containers.json` file that specifies the image using an S3 bucket. @@ -70,4 +69,13 @@ The following is an example `containers.json` file that specifies the image usin - [ - { - "Description": "My Server OVA", - "Format": "ova", +### Example 1: Import an image using an OVA file + +AWS CLI + + +Use the following [import-image](https://docs.aws.amazon.com/cli/latest/reference/ec2/import-image.html) command. + + + aws ec2 import-image \ + --description "$(date '+%b %d %H:%M') My server VM" \ + --license-type "AWS" \ + --disk-containers '[{ + "Format": "OVA", @@ -78,2 +86 @@ The following is an example `containers.json` file that specifies the image usin - } - ] + }]' @@ -81 +88 @@ The following is an example `containers.json` file that specifies the image usin -The following is an example `containers.json` file that specifies the image using a URL in Amazon S3. +PowerShell @@ -84,7 +91 @@ The following is an example `containers.json` file that specifies the image usin - [ - { - "Description": "My Server OVA", - "Format": "ova", - "Url": "s3://amzn-s3-demo-import-bucket/vms/my-server-vm.ova" - } - ] +Use the [Import-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Import-EC2Image.html) cmdlet as follows. @@ -92 +92,0 @@ The following is an example `containers.json` file that specifies the image usin -**Example 2: Import an image with multiple disks** @@ -94 +94,14 @@ The following is an example `containers.json` file that specifies the image usin -Use the following command to import an image with multiple disks. + Import-EC2Image ` + -Description ((Get-Date -Format "MMM dd HH:mm ") + "My server OVA") ` + -LicenseType "AWS" ` + -DiskContainer @( + @{ + Format = "OVA" + UserBucket = @{ + S3Bucket = "amzn-s3-demo-import-bucket" + S3Key = "vms/my-server-vm.ova" + } + } + ) + +### Example 2: Import an image with multiple disks @@ -95,0 +109 @@ Use the following command to import an image with multiple disks. +AWS CLI @@ -97 +110,0 @@ Use the following command to import an image with multiple disks. - aws ec2 import-image --description "My server disks" --disk-containers "file://C:\import\containers.json" @@ -99 +112 @@ Use the following command to import an image with multiple disks. -The following is an example `containers.json` file. +Use the [import-image](https://docs.aws.amazon.com/cli/latest/reference/ec2/import-image.html) command. @@ -102 +115,4 @@ The following is an example `containers.json` file. - [ + aws ec2 import-image \ + --description "$(date '+%b %d %H:%M') My server disks" \ + --license-type "AWS" \ + --disk-containers '[ @@ -108 +124 @@ The following is an example `containers.json` file. - "S3Key": "disks/my-server-vm-disk1.vmdk" + "S3Key": "disks/my-server-vm-disk2.vmdk" @@ -119 +135,4 @@ The following is an example `containers.json` file. - ] + ]' + +PowerShell + @@ -121 +140 @@ The following is an example `containers.json` file. -**Example 3: Import with the encrypted option enabled** +Use the [Import-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Import-EC2Image.html) cmdlet as follows. @@ -123 +141,0 @@ The following is an example `containers.json` file. -Use the following command to import an image with an encrypted root volume. @@ -124,0 +143,66 @@ Use the following command to import an image with an encrypted root volume. + Import-EC2Image ` + -Description ((Get-Date -Format "MMM dd HH:mm ") + "My server disks") ` + -LicenseType "AWS" ` + -DiskContainer @( + @{ + Description = "First disk" + Format = "vmdk" + UserBucket = @{ + S3Bucket = "amzn-s3-demo-import-bucket" + S3Key = "disks/my-server-vm-disk1.vmdk" + } + }, + @{ + Description = "Second disk" + Format = "vmdk" + UserBucket = @{ + S3Bucket = "amzn-s3-demo-import-bucket" + S3Key = "disks/my-server-vm-disk2.vmdk" + } + } + ) + +### Example 3: Import with the encrypted option enabled + +The CMK provided for encryption must not be disabled during the entire import process. For more information, see [Amazon EBS encryption](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html) in the _Amazon EBS User Guide_. + +AWS CLI + + +Use the following [import-image](https://docs.aws.amazon.com/cli/latest/reference/ec2/import-image.html) command. + + + aws ec2 import-image \ + --description "$(date '+%b %d %H:%M') My server OVA" \ + --encrypted \ + --kms-key-id 0ea3fef3-80a7-4778-9d8c-1c0c6EXAMPLE \ + --disk-containers '[{ + "Format": "OVA", + "UserBucket": { + "S3Bucket": "amzn-s3-demo-import-bucket", + "S3Key": "vms/my-server-vm.ova" + } + }]' + +PowerShell + + +Use the [Import-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Import-EC2Image.html) cmdlet as follows. + + + Import-EC2Image ` + -Description ((Get-Date -Format "MMM dd HH:mm ") + "My server disks") ` + -LicenseType "AWS" ` + -DiskContainer @( + @{ + Format = "OVA" + UserBucket = @{ + S3Bucket = "amzn-s3-demo-import-bucket" + S3Key = "vms/my-server-vm.ova" + }0 + } + ) ` + -Encrypted $true ` + -KmsKeyId "alias/aws/ebs" + +### Example 4: Import an image using Migration Hub Orchestrator @@ -126 +210 @@ Use the following command to import an image with an encrypted root volume. - aws ec2 import-image --description "My server disks" --encrypted --kms-key-id 0ea3fef3-80a7-4778-9d8c-1c0c6EXAMPLE --disk-containers "file://C:\import\containers.json" +Console @@ -128 +211,0 @@ Use the following command to import an image with an encrypted root volume. -The CMK provided for encryption must not be disabled during the entire import process. For more information, see [Amazon EBS Encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) in the _Amazon EC2 User Guide_. @@ -130 +213 @@ The CMK provided for encryption must not be disabled during the entire import pr -**Example 4: Import an image using the _Import virtual machine images to AWS_ template in Migration Hub Orchestrator** +###### To import an image using a template