AWS drs: Add arm64 EC2 verification and OS end-of-life install errors
Summary
Documents two new agent installation errors: one requiring arm64 sources to be verified EC2 instances via the signed instance identity document, and one rejecting source servers whose OS has reached vendor end-of-life because they no longer receive security fixes.
Security assessment
The change documents that unsupported/end-of-life operating systems are rejected because they no longer receive security fixes, and that arm64 sources are validated against a signed EC2 instance identity document. This is security-adjacent hardening guidance rather than a fix for a specific vulnerability.
Evidence
**Cause:** The operating system of the source server has passed the end-of-life date published by its vendor. AWS Elastic Disaster Recovery does not accept new source servers on an operating system that the vendor no longer supports. Unsupported operating systems can no longer receive security or compatibility fixes.
Diff
diff --git a/drs/latest/userguide/agent-install-common-errors.md b/drs/latest/userguide/agent-install-common-errors.md index be8488c78..3d13c22f7 100644 --- a//drs/latest/userguide/agent-install-common-errors.md +++ b//drs/latest/userguide/agent-install-common-errors.md @@ -7 +7 @@ -Error: Outdated agent installer versionError: Account not initializedError: Failed to validate AWS credentialsError: Request signature mismatchError: Missing agent installation policyError: Agent IAM role missingError: Server registered to different Region or accountError: Reboot required after uninstallationError: Volume exceeds size limitError: Source server already existsError: Missing marketplace license permissionsError: Secure connection failed while downloading installation filesError: Operating system is not supportedError: Invalid endpointError: Connection attempt failed on port 443Error: Root or administrator privileges required +Error: Outdated agent installer versionError: Account not initializedError: Failed to validate AWS credentialsError: Request signature mismatchError: Missing agent installation policyError: Agent IAM role missingError: Server registered to different Region or accountError: Reboot required after uninstallationError: Volume exceeds size limitError: Source server already existsError: Missing marketplace license permissionsError: Secure connection failed while downloading installation filesError: DRS cannot confirm that the arm64 source is an EC2 instanceError: Operating system is not supportedError: Operating system has reached its end of lifeError: Invalid endpointError: Connection attempt failed on port 443Error: Root or administrator privileges required @@ -38,0 +39,2 @@ This topic covers platform-agnostic installation errors related to AWS credentia + * Error: DRS cannot confirm that the arm64 source is an EC2 instance + @@ -40,0 +43,2 @@ This topic covers platform-agnostic installation errors related to AWS credentia + * Error: Operating system has reached its end of life + @@ -283,0 +288,10 @@ AWS Elastic Disaster Recovery volume limits: +## Error: DRS cannot confirm that the arm64 source is an EC2 instance + +**Error:** **`ARM64 recovery is only supported for verified EC2 instances`** + +A verified Amazon EC2 instance is one that Elastic Disaster Recovery can confirm is an `arm64` Amazon EC2 instance with the instance ID that the agent reports. When you install the agent on an `arm64` source server, Elastic Disaster Recovery confirms this from the instance's signed Amazon EC2 instance identity document, which the agent reads from the instance metadata service. + +**Cause:** The `arm64` source server is not an Amazon EC2 instance, Elastic Disaster Recovery could not read its signed identity document, or the document reports a different instance ID or architecture. + +**Resolution:** Install the agent on the `arm64` Amazon EC2 instance itself. AWS Elastic Disaster Recovery does not support `arm64` source servers in on-premises, vCenter, or other cloud environments. Make sure that the instance can reach the Amazon EC2 instance metadata service. For more information, see [AWS DRS supported Linux operating systems](./Supported-Operating-Systems-Linux.html). + @@ -288 +302,9 @@ AWS Elastic Disaster Recovery volume limits: -**Cause:** The operating system of the source server is not on the AWS Elastic Disaster Recovery supported list. Elastic Disaster Recovery checks the operating system during installation. +**Cause:** The source operating system is not supported. For `arm64`, this includes Windows on `arm64`. Elastic Disaster Recovery checks the operating system during installation. + +**Resolution:** `arm64` source servers must run a 64-bit Linux operating system on an Amazon EC2 instance. Windows on `arm64` is not supported. For `x86_64` source servers, verify that Elastic Disaster Recovery supports the operating system, then run the installer again. For the supported versions, see [AWS DRS supported Linux operating systems](./Supported-Operating-Systems-Linux.html) or [Supported Windows operating systems](./Supported-Operating-Systems-Windows.html). + +## Error: Operating system has reached its end of life + +**Error:** **`The operating system has reached its vendor end of life and is not supported for new source servers.`** + +**Cause:** The operating system of the source server has passed the end-of-life date published by its vendor. AWS Elastic Disaster Recovery does not accept new source servers on an operating system that the vendor no longer supports. Unsupported operating systems can no longer receive security or compatibility fixes. @@ -290 +312 @@ AWS Elastic Disaster Recovery volume limits: -**Resolution:** Verify that Elastic Disaster Recovery supports the operating system of the source server, then run the installer again. For the supported versions, see [Supported Linux operating systems](./Supported-Operating-Systems-Linux.html) or [Supported Windows operating systems](./Supported-Operating-Systems-Windows.html). +**Resolution:** Upgrade the source server to an operating system version that its vendor still supports. Then run the installer again. Source servers that were already registered before the end-of-life date continue to replicate, and can be recovered while they have an approved exception.