AWS AWSEC2 documentation change
Summary
Updated documentation for Amazon Time Sync Service with new terminology, added details about enhanced time synchronization through precision time placement groups, restructured sections for accessing IPv4/IPv6 endpoints, enhanced service, and PTP Hardware Clock (PHC), and included new configuration steps.
Security assessment
The changes primarily focus on improving time synchronization accuracy and adding new features (precision time placement groups, PHC access). While accurate timekeeping supports security operations like log correlation and certificate validation, there's no evidence of addressing a specific vulnerability or weakness. The updates are feature enhancements and documentation restructuring without security incident references.
Diff
diff --git a/AWSEC2/latest/UserGuide/configure-ec2-ntp.md b/AWSEC2/latest/UserGuide/configure-ec2-ntp.md index f56deabf9..3e703e914 100644 --- a//AWSEC2/latest/UserGuide/configure-ec2-ntp.md +++ b//AWSEC2/latest/UserGuide/configure-ec2-ntp.md @@ -7 +7 @@ -Connect to the IPv4 endpoint of the Amazon Time Sync ServiceConnect to the IPv6 endpoint of the Amazon Time Sync ServiceConnect to the PTP hardware clock +Access the IPv4 endpoint of the Amazon Time Sync ServiceAccess the IPv6 endpoint of the Amazon Time Sync ServiceAccess the enhanced Amazon Time Sync ServiceAccess the PTP Hardware Clock (PHC) @@ -11 +11 @@ Connect to the IPv4 endpoint of the Amazon Time Sync ServiceConnect to the IPv6 -The local Amazon Time Sync Service either uses the Network Time Protocol (NTP), or provides a local Precision Time Protocol (PTP) hardware clock on supported instances. The PTP hardware clock supports either an NTP connection (Linux and Windows instances), or a direct PTP connection (Linux instances only). The NTP and direct PTP connections use the same highly accurate time source, but the direct PTP connection is more accurate than the NTP connection. The NTP connection to the Amazon Time Sync Service supports leap smearing while the PTP connection to the PTP hardware clock does not smear time. For more information, see [Leap seconds](./set-time.html#leap-seconds). +The Amazon Time Sync Service provides several methods for your Amazon EC2 instance to synchronize to a local time source. First, any Amazon EC2 instance can reach a local time source over the Network Time Protocol (NTP). In addition, the enhanced Amazon Time Sync Service offers higher-accuracy local time sources to supported Amazon EC2 instances. Launch your supported instance in a placement group with the `precision-time` strategy to reach a higher-accuracy NTP source. Finally, Linux instances launched in a precision time placement group have access to a PTP Hardware Clock (PHC) device and the ability to retrieve hardware packet timestamps. @@ -13,3 +13 @@ The local Amazon Time Sync Service either uses the Network Time Protocol (NTP), -Your instances can access the local Amazon Time Sync Service as follows: - - * Through NTP at the following IP address endpoints: +Any Amazon EC2 instance has access to the local NTP source. You can reach the NTP source over a link-local IP address, which restricts this traffic to within your VPC without the need for specific VPC configuration changes. Your AMI might already have configured your clock synchronization daemon to use the local NTP source by default. This NTP source is available over the following IP addresses: @@ -21,3 +18,0 @@ Your instances can access the local Amazon Time Sync Service as follows: - * (Linux only) Through a direct PTP connection to connect to a local PTP hardware clock: - - * `PHC0` @@ -26,0 +22 @@ Your instances can access the local Amazon Time Sync Service as follows: +Supported Amazon EC2 instances have access to the enhanced Amazon Time Sync Service. To access the enhanced Amazon Time Sync Service, launch a supported instance in a placement group with the `precision-time` strategy. You do not need to configure your instance to benefit from this improvement if you use the NTP link-local IP addresses. Any operating system can use this enhancement. You can verify that you benefit from the enhanced NTP source by using your NTP client of choice. @@ -28,3 +24 @@ Your instances can access the local Amazon Time Sync Service as follows: -Amazon Linux AMIs, Windows AMIs, and most partner AMIs configure your instance to use the NTP IPv4 endpoint by default. This is the recommended setting for most customer workloads. No further configuration is required for instances launched from these AMIs unless you want to use the IPv6 endpoint or connect directly to the PTP hardware clock. - -NTP and PTP connections do not require any VPC configuration changes, and your instance does not require access to the internet. +Linux-based AMIs, running on supported instance families, have the additional option to source time from a PHC device. The ENA driver makes this device available. Both enhanced NTP source and PHC device use the same highly accurate time source. Access to the PHC time source is optimized, leading to a more accurate synchronization of your Amazon EC2 instance. @@ -34 +28,3 @@ NTP and PTP connections do not require any VPC configuration changes, and your i - * There is a 1024 packet per second (PPS) limit to services that use [link-local](./using-instance-addressing.html#link-local-addresses) addresses. This limit includes the aggregate of [Route 53 Resolver DNS Queries](https://docs.aws.amazon.com/vpc/latest/userguide/AmazonDNS-concepts.html#vpc-dns-limits), [Instance Metadata Service (IMDS)](./instancedata-data-retrieval.html) requests, Amazon Time Service Network Time Protocol (NTP) requests, and [Windows Licensing Service (for Microsoft Windows based instances)](https://aws.amazon.com/windows/resources/licensing/) requests. + * The NTP time source offers a leap smearing view of the UTC timescale, while the PHC does not smear time. For more information, see [Leap seconds](./set-time.html#leap-seconds). + + * Only Linux instances have access to the local PTP hardware clock. Windows instances must use NTP to access the enhanced Amazon Time Sync Service. @@ -36 +32 @@ NTP and PTP connections do not require any VPC configuration changes, and your i - * Only Linux instances can use a _direct PTP connection_ to connect to the local PTP hardware clock. Windows instances use NTP to connect to the local PTP hardware clock. + * There is a 1024 packet per second (PPS) limit to services that use [link-local](./using-instance-addressing.html#link-local-addresses) addresses. This limit includes the aggregate of [Route 53 Resolver DNS Queries](https://docs.aws.amazon.com/vpc/latest/userguide/AmazonDNS-concepts.html#vpc-dns-limits), [Instance Metadata Service (IMDS)](./instancedata-data-retrieval.html) requests, Amazon Time Sync Service Network Time Protocol (NTP) requests, and [Windows Licensing Service (for Microsoft Windows based instances)](https://aws.amazon.com/windows/resources/licensing/) requests. @@ -43 +39 @@ NTP and PTP connections do not require any VPC configuration changes, and your i - * Connect to the IPv4 endpoint of the Amazon Time Sync Service + * Access the IPv4 endpoint of the Amazon Time Sync Service @@ -45 +41 @@ NTP and PTP connections do not require any VPC configuration changes, and your i - * Connect to the IPv6 endpoint of the Amazon Time Sync Service + * Access the IPv6 endpoint of the Amazon Time Sync Service @@ -47 +43 @@ NTP and PTP connections do not require any VPC configuration changes, and your i - * Connect to the PTP hardware clock + * Access the enhanced Amazon Time Sync Service @@ -48,0 +45 @@ NTP and PTP connections do not require any VPC configuration changes, and your i + * Access the PTP Hardware Clock (PHC) @@ -52 +49,2 @@ NTP and PTP connections do not require any VPC configuration changes, and your i -## Connect to the IPv4 endpoint of the Amazon Time Sync Service + +## Access the IPv4 endpoint of the Amazon Time Sync Service @@ -68,2 +66,4 @@ Run the following command. In the output, the line that starts with `^*` indicat - chronyc sources -v | grep -F ^* - ^* 169.254.169.123 3 4 377 14 +12us[+9653ns] +/- 290us + [ec2-user ~]$ chronyc sources -v | grep -F ^* + + + ^* 169.254.169.123 3 4 377 13 -4325ns[-9201ns] +/- 401us @@ -113,10 +113,10 @@ In the output, `^*` indicates the preferred time source. - Ref time (UTC) : Wed Nov 22 13:18:34 2017 - System time : 0.000000626 seconds slow of NTP time - Last offset : +0.002852759 seconds - RMS offset : 0.002852759 seconds - Frequency : 1.187 ppm fast - Residual freq : +0.020 ppm - Skew : 24.388 ppm - Root delay : 0.000504752 seconds - Root dispersion : 0.001112565 seconds - Update interval : 64.4 seconds + Ref time (UTC) : Wed May 06 00:39:14 2026 + System time : 0.000002191 seconds fast of NTP time + Last offset : +0.000002164 seconds + RMS offset : 0.000082968 seconds + Frequency : 3.710 ppm slow + Residual freq : +0.002 ppm + Skew : 0.504 ppm + Root delay : 0.000362541 seconds + Root dispersion : 0.000225028 seconds + Update interval : 16.1 seconds @@ -163 +163 @@ In the output, the line starting with `^*` indicates the preferred time source. - Reference ID : 169.254.169.123 (169.254.169.123) + Reference ID : A9FEA97B (169.254.169.123) @@ -165,10 +165,10 @@ In the output, the line starting with `^*` indicates the preferred time source. - Ref time (UTC) : Wed Nov 29 07:41:57 2017 - System time : 0.000000011 seconds slow of NTP time - Last offset : +0.000041659 seconds - RMS offset : 0.000041659 seconds - Frequency : 10.141 ppm slow - Residual freq : +7.557 ppm - Skew : 2.329 ppm - Root delay : 0.000544 seconds - Root dispersion : 0.000631 seconds - Update interval : 2.0 seconds + Ref time (UTC) : Wed May 06 00:39:14 2026 + System time : 0.000002191 seconds fast of NTP time + Last offset : +0.000002164 seconds + RMS offset : 0.000082968 seconds + Frequency : 3.710 ppm slow + Residual freq : +0.002 ppm + Skew : 0.504 ppm + Root delay : 0.000362541 seconds + Root dispersion : 0.000225028 seconds + Update interval : 16.1 seconds @@ -273 +273 @@ HKLM:\System\CurrentControlSet\services\w32time\TimeProviders\NtpClient | Specia -## Connect to the IPv6 endpoint of the Amazon Time Sync Service +## Access the IPv6 endpoint of the Amazon Time Sync Service @@ -275 +275 @@ HKLM:\System\CurrentControlSet\services\w32time\TimeProviders\NtpClient | Specia -This section explains how the steps described in Connect to the IPv4 endpoint of the Amazon Time Sync Service differ if you are configuring your instance to use the local Amazon Time Sync Service through the IPv6 endpoint. It doesn't explain the entire Amazon Time Sync Service configuration process. +This section explains how the steps described in Access the IPv4 endpoint of the Amazon Time Sync Service differ if you are configuring your instance to use the local Amazon Time Sync Service through the IPv6 endpoint. It doesn't explain the entire Amazon Time Sync Service configuration process. @@ -311 +311,36 @@ In the output, verify that `NtpServer` displays the `fd00:ec2::123` IPv6 endpoin -## Connect to the PTP hardware clock +## Access the enhanced Amazon Time Sync Service + +The enhanced Amazon Time Sync Service offers higher accuracy local time sources to supported Amazon EC2 instances. Instances launched in a placement group with a `precision-time` strategy can access these local sources. We recommend precision time placement groups for applications that require more accurate time from either the link-local NTP source, or a PTP Hardware Clock (PHC) device on a Linux instance. When you launch instances into a precision time placement group, AWS places them on supported hardware with direct access to high-precision time sources in AWS infrastructure. + +###### Key benefits + + * **Improved NTP source by default** — Your instance has immediate access to an enhanced local NTP time source, if you use the NTP link-local IP addresses as described in the preceding section. + + * **Microsecond-accurate clock synchronization** — Configure your Amazon EC2 Linux instance to use a PTP Hardware Clock device and achieve microsecond-accurate clock synchronization. + + * **Simplified deployment** — Single placement strategy ensures all instances have precision time capabilities. + + * **Hardware packet timestamping** — Access low-level packet timestamps for network measurements. + + * **No additional cost** — Precision time placement groups are available at no extra charge. + + + + +###### Rules and limitations + + * Precision time placement groups are available in all AWS Commercial Regions. + + * Precision time placement groups support the following Gen7 and later Amazon EC2 instance families: + + * **General purpose** : M7a, M7g, M7g-flex, M7gd, M7i, M7i-flex, M8a, M8g, M8g-flex + + * **Compute optimized** : C7a, C7gd, C7i, C7i-flex, C8g, C8g-flex, C8gd + + * **Memory optimized** : R7a, R7g, R7i, R7id, R8g, X8adez, X8adz-3tb, X8adz-6tb, X8adzs, X8aedez, X8aedz-3tb, X8aedz-6tb, X8aez, X8az, X8g, X8ge + + * **Storage optimized** : I8g, I8ge + + * If you start or launch an instance in a precision time placement group and there is insufficient hardware to give access to the enhanced Amazon Time Sync Service, the request fails. + + * If you stop an instance in a precision time placement group and then start it again, it still runs in the placement group. However, the start might fail if there is insufficient hardware to give access to the enhanced Amazon Time Sync Service. @@ -313 +348 @@ In the output, verify that `NtpServer` displays the `fd00:ec2::123` IPv6 endpoin -The PTP hardware clock is part of the [AWS Nitro System](https://docs.aws.amazon.com/ec2/latest/instancetypes/ec2-nitro-instances.html), so it is directly accessible on supported bare metal and virtualized EC2 instances without using any customer resources. + * Amazon EC2 continuously adds hardware that supports the enhanced Amazon Time Sync Service. If your request fails due to insufficient capacity, try again later or try a different Availability Zone. For more information, see [Troubleshoot Amazon EC2 instance launch issues](./troubleshooting-launch.html). @@ -315 +350,48 @@ The PTP hardware clock is part of the [AWS Nitro System](https://docs.aws.amazon -The NTP endpoints for the PTP hardware clock are the same as those for the regular Amazon Time Sync Service. If your instance has a PTP hardware clock and you configured the NTP connection (to either the IPv4 or IPv6 endpoint), your instance time is automatically sourced from the PTP hardware clock over NTP. + * Rules and limitations of placement groups apply. For more information, see [Placement groups for your Amazon EC2 instances](./placement-groups.html) + + + + +### Create a precision time placement group + +You can create a precision time placement group using the AWS CLI, AWS Management Console, or AWS SDKs, by specifying the `precision-time` strategy. + +###### Using AWS CLI + +Run the following command: + + + aws ec2 create-placement-group \ + --group-name my-precision-time-pg \ + --strategy precision-time + +The command returns a placement group ARN that you use when creating capacity reservations, and a group name or group ID that you use when launching instances and linking placement groups. + +### Launch an instance + +After you create a precision time placement group, specify it when launching instances to access the enhanced Amazon Time Sync Service: + + + aws ec2 run-instances \ + --image-id ami-0abcdef1234567890 \ + --instance-type r7g.2xlarge \ + --placement GroupId=pg-0aaa1111111111111 + +### Verify access to the enhanced Amazon Time Sync Service + +After you launch your instance in a precision time placement group, you benefit from an enhanced NTP time source. + +For example, if you use the chronyd daemon on your instance, you can verify that the NTP time source is now referred to as a Stratum 1 and has improved clock accuracy metrics: + + + [ec2-user ~]$ chronyc sources + + + MS Name/IP address Stratum Poll Reach LastRx Last sample + =============================================================================== + ^* 169.254.169.123 1 4 377 3 +3477ns[+4689ns] +/- 91us + +Verify the time synchronization metrics that are reported by `chrony`. + + + [ec2-user ~]$ chronyc tracking @@ -317 +399,18 @@ The NTP endpoints for the PTP hardware clock are the same as those for the regul -For Linux instances, you can configure a _direct_ PTP connection, which will give you more accurate time than the NTP connection. Windows instances only support an NTP connection to the PTP hardware clock.