Thursday, July 21, 2011

Fighting with Amazon EC2 AMI

There is no doubt that Amazon EC2 is one of the most successful and useful cloud services. However, a few days ago I had the nerve breaking experience of trying to ec2-register an amazon AMI image. This task is needed when you want to save your work so you can easily load it next time you run. Amazon AMI tools is one of the worst designed and implemented tools I have ever encountered. You need a lot of patience when dealing with it. I wrote down some of the errors I encountered.
(I thought that by having a PhD and working for 15 years on Linux I will be immune to this kinds of errors, but I was absolutely wrong..) The reader should be warned,
that I did not collect error on the web, I simply encountered all of the below errors, until eventually I got so tired so I did not document everything from a certain point.

Basically, what you want to do is to run 3 commands. Usually it should not take more than a few minutes. However, if you manage to run those command in less than a few hours you are absolutely lucky.
Those are the command you like to run:
sudo -E /opt/aws/bin/ec2-bundle-vol -k [path to your x.509 private key] -c [path to your x.509 public key] -u [Amazon 12 digit user id] -d /mnt -p [bundle file name] -r x86_64
sudo -E /opt/aws/bin/ec2-upload-bundle -b [bundle file name] -m /mnt/[bundle file name].manifest.xml -s [Amazon AWS secret string] -a [Amazon AWS ID string]
sudo -E ec2-register -K [location of X.509 private key] -C [location of x.509 certificate] --name [bucket name]/[image name] --region us-east-1 [bucket name]/[image name].manifest.xml

Potential problems. If the process failed and you tried again you may get an error:
/opt/aws/amitools/ec2/lib/ec2/platform/linux/image.rb:154:in `mount_image': image already mounted (FatalError)
    from /opt/aws/amitools/ec2/lib/ec2/platform/linux/image.rb:81:in `make'
    from /opt/aws/amitools/ec2/lib/ec2/amitools/bundlevol.rb:151:in `bundle_vol'
    from /opt/aws/amitools/ec2/lib/ec2/amitools/bundlevol.rb:193:in `main'
    from /opt/aws/amitools/ec2/lib/ec2/amitools/tool_base.rb:201:in `run'
    from /opt/aws/amitools/ec2/lib/ec2/amitools/bundlevol.rb:201

solution: using the "mount" command find the mounted image and unmount it using the "sudo unmount XXX" command.

/opt/aws/bin/ec2-bundle-vol: line 3: EC2_HOME: Neither of EC2_AMITOOL_HOME or EC2_HOME environment variables are set
Assuming AMITOOL is isntalled, try to use sudo -E. If this did not work, try to set (assuming working on bash shell):
export EC2_AMITOOL_HOME=/home/ubuntu/ami-tools/ec2-ami-tools-1.3-57676/
where you should point the path to where ami-tools are installed. If they are not installed
you need to install EC2 AMITOOLs. And then set the environment variable using "setenv" or "export" command.

--user has invalid value 'AKIAJWASWE2DSWQFKILA': the user ID should consist of 12 digits (optionally hyphenated); this should not be your Access Key ID
Try 'ec2-bundle-vol --help'

You ou gave the wrong key, look for a numeric key id in amazon AWS website of the format 0000-0000-0000. This key is especially hard to find within all the menus.

ERROR: the specified image file /mnt/ already exists

Solution: remove the image file created using the command
sudo rm -fR /mnt/

The specified bucket is not S3 v2 safe (see S3 documentation for details):
Solution: Looks like an EC2 bug - underscore and capital letters are allowed but result in this warning. If you try to ignore this warning at this point, you will get much worser errors later. Try to avoid this warning.

mke2fs 1.41.12 (17-May-2010)
error writing /etc/mtab.tmp: No space left on device

You tried so many times, you got out of disk space.. Need to clean up files or restart image and retry again.

Neither a 'manifest' or 'block-device-mapping' have been specified; at least one is required. (-h for usage)

You should have both used the -n flag to specify a bucket name, and then the path of the bucketname/imagename.manifest.xml . By the way bucket name is flexible - it does not have to be image name.

1) Client.InvalidManifest: HTTP 403 (Forbidden) response for URL check your S3 ACLs are correct.
2) Client.InvalidManifest: HTTP 404 (Not Found) response for URL check your manifest path is correct and in the correct region.

something in the process has gone wrong - either bucket name is wrong or upload failed.. Need to do everything correctly from the beginning.

ERROR: Parameter problem: Expecting S3 URI with just the bucket name set instead of 'graphlab_org_release_v1234'
Need to add s3:// when using the command: s3cmd mb

ERROR: Error talking to S3: Curl.Error(51): SSL: certificate subject name '*' does not match target host name ''.
Solution: no clue what I did - I started to get out of focus at this point. Probably started all over again.. :-(

Problem: Client.InvalidAMIName.Duplicate: AMI name graphlaborgreleasev1234 is already in use by AMI ami-98946ef1
Solution: this happens when you try to register a new AMI with a name you already gave to an older AMI need to rename.

Hopefully, after all this mess, you managed to ec2-register.. and got a printout of
the type:
IMAGE AMI-12120930
And I ask : why not simply add a UI option from AWS consule to register an image???

Final comment: I have a quick email exchange with James Hamilton, VP in Amazon and I sent him this link.  I got back the following note: Sorry you had a bad experience with EC2.
I would like to take this opportunity to clarify that my overall experience with EC2 is very good. But still some interfaces could be improved.


  1. I thought that the aws console does have that feature. Right click the image and choose 'Create Image'. May only work on EBS backed VMs, though.


  2. RE: ERROR: Error talking to S3: Curl.Error(51): SSL: certificate subject name '*' does not match target host name ''.

    Change your dots to dashes in your -b argument. The cert for * matches then but not with the dots.

  3. Hello
    I know that is a old post, and greg post a problem, but I see that he don't have a reply yet, so if someone else have this problem, he should know that the bucket name should not contain dots, like they say so you should have something like this to work:
    Also, I try to move a image from Us-east to US-west and it seem't that Oregon is not supported. So I have to reinstall the server from scratch .
    Amazon really should take a look to theyr interface.


  4. Wow thanks for saving so much time!!!

  5. Enter the year 2014, encountered most of these problems. And another one: my secret key contained a "/" causing bundle upload to fail, had to regenerate keys until I got one without / or +. Kudos for the umount :)