AWS evs documentation change
Summary
Added four new troubleshooting sections for Windows Server entitlement issues in Amazon EVS: appliance reachability failures, unsupported guest OS, entitlement removal status, and VM disconnection/isolation/missing inventory problems
Security assessment
The changes add troubleshooting documentation for operational issues with Windows Server entitlements, not security vulnerabilities. However, they include security-related guidance about verifying credentials in AWS Secrets Manager, checking firewall rules for HTTPS/SSH access, and ensuring DNS security. These are operational security best practices but don't address a specific security vulnerability.
Diff
diff --git a/evs/latest/userguide/troubleshooting.md b/evs/latest/userguide/troubleshooting.md index b15e30a9a..3818cc870 100644 --- a//evs/latest/userguide/troubleshooting.md +++ b//evs/latest/userguide/troubleshooting.md @@ -7 +7 @@ -Troubleshoot failed environment status checksvSphere HA agent on this host could not reach isolation addressvSAN upgrade prechecks fail for ESX host clusterAdd host failure due to incompatible cluster imageSDDC Manager fails VCF host validation during host commissioning +Troubleshoot failed environment status checksvSphere HA agent on this host could not reach isolation addressvSAN upgrade prechecks fail for ESX host clusterAdd host failure due to incompatible cluster imageSDDC Manager fails VCF host validation during host commissioningWindows Server entitlement status is At Risk due to appliance reachability failureEntitlement failed due to unsupported guest OSEntitlement status is entitlement removedEntitlement removed due to VM disconnect, isolated, or missing from inventory @@ -159,0 +160,104 @@ These steps require temporarily adding the host to vCenter outside of SDDC Manag +## Windows Server entitlement status is At Risk due to appliance reachability failure + +An entitlement enters the at risk state when the associated Amazon EVS connector fails its reachability check for the VCF management appliance. For Windows Server entitlements, you have 8 hours from the point the entitlement reaches the at risk status to restore the connection. If the connection is not restored within this period, entitlements are automatically dropped and Windows Server usage tracking is stopped. + +To resolve this issue, check the following: + + * Verify the connector state is Active and its reachability check status is Failed. + + * Verify that the appliance credentials stored in AWS Secrets Manager are current and correct. If the credentials have been rotated in the appliance, update the values in the existing Secrets Manager secret. If you need to point to a different secret, use UpdateEnvironmentConnector to update the secret identifier. + + * Ensure that your DNS servers are reachable from the service access subnet, DNS records for the appliance FQDN are valid, and no duplicate hostnames or IP addresses exist. + + * Verify that firewall rules allow HTTPS/SSH access to the management VM VLAN subnet and TCP/UDP access to DNS servers. + + * Ensure that the appliance is running and accessible. + + + + +Once the connection is restored, entitlements will automatically return to the healthy Created state. If entitlements have already been dropped and have the Entitlement Removed state, you must create new entitlements after the connector returns to an Active state with a passed reachability check. + +If you are still unable to resolve the issue after following this guidance, we recommend that you reach out to AWS Support for further assistance. + +## Entitlement failed due to unsupported guest OS + +An entitlement creation fails or an existing entitlement is removed when Amazon EVS detects that the VM is running a guest operating system that is not supported for Amazon EVS Windows Server Licensing. + +This can occur when: + + * A VM with an existing Windows Server entitlement is reconfigured to use an unsupported OS version or a non-Windows operating system. + + * An entitlement creation failed because of a VM that is already running an unsupported guest OS. + + + + +To resolve this issue: + + * Verify the connector state is Active and its reachability check status is Passed. + + * Verify the guest OS configured on the VM. Amazon EVS Windows Server Licensing supports Windows Server 2016 or later. + + * Reconfigure the VM to use a supported Windows Server version. + + * After updating the guest OS, create a new entitlement for the VM. + + * (**Optional**) Delete the entitlement in the Entitlement Removed state. + + + + +If you are still unable to resolve the issue after following this guidance, we recommend that you reach out to AWS Support for further assistance. + +## Entitlement status is entitlement removed + +An entitlement with the Entitlement Removed status indicates that Amazon EVS has removed the entitlement for the VM. When an entitlement is removed, Windows Server usage tracking stops for the affected VM. + +This status can result from several causes: + + * Appliance reachability failure that exceeded the 8-hour grace period. See Windows Server entitlement status is At Risk due to appliance reachability failure. + + * VM no longer present in the appliance inventory. See Entitlement removed due to VM disconnect, isolated, or missing from inventory. + + * VM became disconnected or isolated from its host. See Entitlement removed due to VM disconnect, isolated, or missing from inventory. + + * VM guest OS was changed to an unsupported version. See Entitlement failed due to unsupported guest OS. + + + + +To restore entitlement: + + * Check the entitlement’s error details to identify the specific cause of the removal. + + * Resolve the underlying issue. + + * Create a new entitlement for the VM once the connector is in an Active state with a reachability check in a Passed state. + + * (**Optional**) Delete the entitlement in the Entitlement Removed state. + + + + +If you are still unable to resolve the issue after following this guidance, we recommend that you reach out to AWS Support for further assistance. + +## Entitlement removed due to VM disconnect, isolated, or missing from inventory + +An entitlement is removed when Amazon EVS detects that a VM has become disconnected, isolated, or is no longer present in the appliance inventory. The entitlement is removed immediately and usage tracking is stopped. + +To resolve this issue: + + * Verify the connector state is Active and its reachability check status is Passed. + + * Check the VM’s connection state in your appliance. A disconnected or isolated VM may indicate a host or network issue. + + * Resolve the underlying host or network issue causing the VM to be disconnected or isolated. + + * After the VM is reconnected and running normally, create a new entitlement to resume Windows Server usage. + + + + +If you are still unable to resolve the issue after following this guidance, we recommend that you reach out to AWS Support for further assistance. +