Deploying RHEL 9 on Amazon Web Services

1. Select the optimal cloud provider for your use case, based on your requirements and the current offer on the market.

   The cloud providers currently certified for running RHEL instances are:

   • Amazon Web Services (AWS)
   • Google Cloud Platform (GCP)

   • Microsoft Azure

     Note

     This document specifically talks about deploying RHEL on AWS.

2. Create a RHEL cloud instance on your chosen cloud platform. For more information, see Methods for creating RHEL cloud instances.
3. To keep your RHEL deployment up-to-date, use Red Hat Update Infrastructure (RHUI).

Procedure

1. Install Python 3 and the pip tool:

   # dnf install python3 python3-pip

   Copy to Clipboard Toggle word wrap

2. Install the AWS command-line tools with pip:

   # pip3 install awscli

   Copy to Clipboard Toggle word wrap

3. Set your profile. The terminal prompts you to provide your credentials, region and output format:

   $ aws configure
   AWS Access Key ID [None]:
   AWS Secret Access Key [None]:
   Default region name [None]:
   Default output format [None]:

   Copy to Clipboard Toggle word wrap

4. Define a name for your bucket and create a bucket:

   $ BUCKET=bucketname
   $ aws s3 mb s3://$BUCKET

   Copy to Clipboard Toggle word wrap

   Replace bucketname with the actual bucket name. It must be a globally unique name. As a result, your bucket is created.

5. To grant permission to access the S3 bucket, create a vmimport S3 Role in the AWS Identity and Access Management (IAM), if you have not already done so in the past:

   1. Create a trust-policy.json file with the trust policy configuration, in the JSON format. For example:

      {
          "Version": "2022-10-17",
          "Statement": [{
              "Effect": "Allow",
              "Principal": {
                  "Service": "vmie.amazonaws.com"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                  "StringEquals": {
                      "sts:Externalid": "vmimport"
                  }
              }
          }]
      }

      Copy to Clipboard Toggle word wrap

   2. Create a role-policy.json file with the role policy configuration, in the JSON format. For example:

      {
          "Version": "2012-10-17",
          "Statement": [{
              "Effect": "Allow",
              "Action": ["s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket"],
              "Resource": ["arn:aws:s3:::%s", "arn:aws:s3:::%s/"] }, { "Effect": "Allow", "Action": ["ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:RegisterImage", "ec2:Describe"],
              "Resource": "*"
          }]
      }
      $BUCKET $BUCKET

      Copy to Clipboard Toggle word wrap

   3. Create a role for your Amazon Web Services account, by using the trust-policy.json file:

      $ aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json

      Copy to Clipboard Toggle word wrap

   4. Embed an inline policy document, by using the role-policy.json file:

      $ aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json

      Copy to Clipboard Toggle word wrap

Procedure

1. Using the text editor, create a configuration file with the following content:

   provider = "aws"
   [settings]
   accessKeyID = "AWS_ACCESS_KEY_ID"
   secretAccessKey = "AWS_SECRET_ACCESS_KEY"
   bucket = "AWS_BUCKET"
   region = "AWS_REGION"
   key = "IMAGE_KEY"

   Copy to Clipboard Toggle word wrap

   Replace values in the fields with your credentials for accessKeyID, secretAccessKey, bucket, and region. The IMAGE_KEY value is the name of your VM Image to be uploaded to EC2.

2. Save the file as CONFIGURATION-FILE.toml and close the text editor.

3. Start the compose to upload it to AWS:

   # composer-cli compose start blueprint-name image-type image-key configuration-file.toml

   Copy to Clipboard Toggle word wrap

   Replace:

   • blueprint-name with the name of the blueprint you created
   • image-type with the ami image type.
   • image-key with the name of your VM Image to be uploaded to EC2.

   • configuration-file.toml with the name of the configuration file of the cloud provider.

     Note

     You must have the correct AWS Identity and Access Management (IAM) settings for the bucket you are going to send your customized image to. You have to set up a policy to your bucket before you are able to upload images to it.

4. Check the status of the image build:

   # composer-cli compose status

   Copy to Clipboard Toggle word wrap

   After the image upload process is complete, you can see the "FINISHED" status.

1. Access EC2 on the menu and select the correct region in the AWS console. The image must have the available status, to indicate that it was successfully uploaded.
2. On the dashboard, select your image and click Launch.

Procedure

1. In the RHEL image builder dashboard, click the blueprint name that you previously created.
2. Select the tab Images.

3. Click Create Image to create your customized image.

   The Create Image window opens.

   1. From the Type drop-down menu list, select Amazon Machine Image Disk (.raw).
   2. Check the Upload to AWS checkbox to upload your image to the AWS Cloud and click Next.

   3. To authenticate your access to AWS, type your AWS access key ID and AWS secret access key in the corresponding fields. Click Next.

      Note

      You can view your AWS secret access key only when you create a new Access Key ID. If you do not know your Secret Key, generate a new Access Key ID.

   4. Type the name of the image in the Image name field, type the Amazon bucket name in the Amazon S3 bucket name field and type the AWS region field for the bucket you are going to add your customized image to. Click Next.

   5. Review the information and click Finish.

      Optionally, click Back to modify any incorrect detail.

      Note

      You must have the correct IAM settings for the bucket you are going to send your customized image. This procedure uses the IAM Import and Export, so you have to set up a policy to your bucket before you are able to upload images to it. For more information, see Required Permissions for IAM Users.

4. A pop-up on the upper right informs you of the saving progress. It also informs that the image creation has been initiated, the progress of this image creation and the subsequent upload to the AWS Cloud.

   After the process is complete, you can see the Image build complete status.

5. In a browser, access Service→EC2.

   1. On the AWS console dashboard menu, choose the correct region. The image must have the Available status, to indicate that it is uploaded.
   2. On the AWS dashboard, select your image and click Launch.
6. A new window opens. Choose an instance type according to the resources you need to start your image. Click Review and Launch.
7. Review your instance start details. You can edit each section if you need to make any changes. Click Launch

8. Before you start the instance, select a public key to access it.

   You can either use the key pair you already have or you can create a new key pair.

   Follow the next steps to create a new key pair in EC2 and attach it to the new instance.

   1. From the drop-down menu list, select Create a new key pair.
   2. Enter the name to the new key pair. It generates a new key pair.
   3. Click Download Key Pair to save the new key pair on your local system.

9. Then, you can click Launch Instance to start your instance.

   You can check the status of the instance, which displays as Initializing.

10. After the instance status is running, the Connect button becomes available.

11. Click Connect. A window appears with instructions on how to connect by using SSH.

    1. Select A standalone SSH client as the preferred connection method to and open a terminal.

    2. In the location you store your private key, ensure that your key is publicly viewable for SSH to work. To do so, run the command:

       $ chmod 400 <_your-instance-name.pem_>

       Copy to Clipboard Toggle word wrap

    3. Connect to your instance by using its Public DNS:

       $ ssh -i <_your-instance-name.pem_> ec2-user@<_your-instance-IP-address_>

       Copy to Clipboard Toggle word wrap

    4. Type yes to confirm that you want to continue connecting.

       As a result, you are connected to your instance over SSH.

Procedure

1. Launch the AWS Console.
2. Click on your AWS Account ID to display the drop-down menu and select My Security Credentials.
3. Click Users.
4. Select the user and open the Summary screen.
5. Click the Security credentials tab.
6. Click Create access key.
7. Download the .csv file (or save both keys). You need to enter these keys when creating the fencing device.

Procedure

1. Install the AWS command line tools by using the dnf command.

   # dnf install awscli

   Copy to Clipboard Toggle word wrap

2. Use the aws --version command to verify that you installed the AWS CLI.

   $ aws --version
   aws-cli/1.19.77 Python/3.6.15 Linux/5.14.16-201.fc34.x86_64 botocore/1.20.77

   Copy to Clipboard Toggle word wrap

3. Configure the AWS command line client according to your AWS access details.

   $ aws configure
   AWS Access Key ID [None]:
   AWS Secret Access Key [None]:
   Default region name [None]:
   Default output format [None]:

   Copy to Clipboard Toggle word wrap

Procedure

1. From the AWS EC2 Dashboard, select Images and then AMIs.
2. Right-click on your image and select Launch.

3. Choose an Instance Type that meets or exceeds the requirements of your workload. Depending on your HA application, each instance may need to have higher capacity.

   See Amazon EC2 Instance Types for information about instance types.

4. Click Next: Configure Instance Details.

   1. Enter the Number of instances you want to create for the cluster. This example procedure uses three cluster nodes.

      Note

      Do not launch into an Auto Scaling Group.

   2. For Network, select the VPC you created in Set up the AWS environment. Select the subnet for the instance to create a new subnet.

   3. Select Enable for Auto-assign Public IP. These are the minimum selections you need to make for Configure Instance Details. Depending on your specific HA application, you may need to make additional selections.

      Note

      These are the minimum configuration options necessary to create a basic instance. Review additional options based on your HA application requirements.

5. Click Next: Add Storage and verify that the default storage is sufficient. You do not need to modify these settings unless your HA application requires other storage options.

6. Click Next: Add Tags.

   Note

   Tags can help you manage your AWS resources. See Tagging Your Amazon EC2 Resources for information about tagging.

7. Click Next: Configure Security Group. Select the existing security group you created in Setting up the AWS environment.
8. Click Review and Launch and verify your selections.
9. Click Launch. You are prompted to select an existing key pair or create a new key pair. Select the key pair you created when Setting up the AWS environment.
10. Click Launch Instances.

11. Click View Instances. You can name the instance(s).

    Note

    Alternatively, you can launch instances by using the AWS CLI. See Launching, Listing, and Terminating Amazon EC2 Instances in the Amazon documentation for more information.

Procedure

1. Move the key file from the Downloads directory to your Home directory or to your ~/.ssh directory.

2. Change the permissions of the key file so that only the root user can read it.

   # chmod 400 KeyName.pem

   Copy to Clipboard Toggle word wrap

Procedure

1. Launch the AWS Console and select the EC2 instance.
2. Click Connect and select A standalone SSH client.
3. From your SSH terminal session, connect to the instance by using the AWS example provided in the pop-up window. Add the correct path to your KeyName.pem file if the path is not shown in the example.

Procedure

1. Remove the AWS Red Hat Update Infrastructure (RHUI) client.

   $ sudo -i
   # dnf -y remove rh-amazon-rhui-client*

   Copy to Clipboard Toggle word wrap

2. Register the VM with Red Hat.

   # subscription-manager register

   Copy to Clipboard Toggle word wrap

3. Disable all repositories.

   # subscription-manager repos --disable=*

   Copy to Clipboard Toggle word wrap

4. Enable the RHEL 9 Server HA repositories.

   # subscription-manager repos --enable=rhel-9-for-x86_64-highavailability-rpms

   Copy to Clipboard Toggle word wrap

5. Update the RHEL AWS instance.

   # dnf update -y

   Copy to Clipboard Toggle word wrap

6. Install the Red Hat High Availability Add-On software packages, along with the AWS fencing agent from the High Availability channel.

   # dnf install pcs pacemaker fence-agents-aws

   Copy to Clipboard Toggle word wrap

7. The user hacluster was created during the pcs and pacemaker installation in the previous step. Create a password for hacluster on all cluster nodes. Use the same password for all nodes.

   # passwd hacluster

   Copy to Clipboard Toggle word wrap

8. Add the high availability service to the RHEL Firewall if firewalld.service is installed.

   # firewall-cmd --permanent --add-service=high-availability
   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

9. Start the pcs service and enable it to start on boot.

   # systemctl start pcsd.service
   # systemctl enable pcsd.service

   Copy to Clipboard Toggle word wrap
10. Edit /etc/hosts and add RHEL host names and internal IP addresses. For more information, see the Red Hat Knowledgebase solution How should the /etc/hosts file be set up on RHEL cluster nodes?.

Procedure

1. On one of the nodes, enter the following command to authenticate the pcs user hacluster. In the command, specify the name of each node in the cluster.

   # pcs host auth <hostname1> <hostname2> <hostname3>

   Copy to Clipboard Toggle word wrap

   Example:

   [root@node01 clouduser]# pcs host auth node01 node02 node03
   Username: hacluster
   Password:
   node01: Authorized
   node02: Authorized
   node03: Authorized

   Copy to Clipboard Toggle word wrap

2. Create the cluster.

   # pcs cluster setup <cluster_name> <hostname1> <hostname2> <hostname3>

   Copy to Clipboard Toggle word wrap

   Example:

   [root@node01 clouduser]# pcs cluster setup new_cluster node01 node02 node03
   
   [...]
   
   Synchronizing pcsd certificates on nodes node01, node02, node03...
   node02: Success
   node03: Success
   node01: Success
   Restarting pcsd on the nodes in order to reload the certificates...
   node02: Success
   node03: Success
   node01: Success

   Copy to Clipboard Toggle word wrap

Verification

1. Enable the cluster.

   [root@node01 clouduser]# pcs cluster enable --all
   node02: Cluster Enabled
   node03: Cluster Enabled
   node01: Cluster Enabled

   Copy to Clipboard Toggle word wrap

2. Start the cluster.

   [root@node01 clouduser]# pcs cluster start --all
   node02: Starting Cluster...
   node03: Starting Cluster...
   node01: Starting Cluster...

   Copy to Clipboard Toggle word wrap

Standard procedure

1. Enter the following AWS metadata query to get the Instance ID for each node. You need these IDs to configure the fence device. See Instance Metadata and User Data for additional information.

   # echo $(curl -s http://169.254.169.254/latest/meta-data/instance-id)

   Copy to Clipboard Toggle word wrap

   Example:

   [root@ip-10-0-0-48 ~]# echo $(curl -s http://169.254.169.254/latest/meta-data/instance-id) i-07f1ac63af0ec0ac6

   Copy to Clipboard Toggle word wrap

2. Enter the following command to configure the fence device. Use the pcmk_host_map command to map the RHEL host name to the Instance ID. Use the AWS Access Key and AWS Secret Access Key that you previously set up.

   # pcs stonith \
       create <name> fence_aws access_key=access-key secret_key=<secret-access-key> \
       region=<region> pcmk_host_map="rhel-hostname-1:Instance-ID-1;rhel-hostname-2:Instance-ID-2;rhel-hostname-3:Instance-ID-3" \
       power_timeout=240 pcmk_reboot_timeout=480 pcmk_reboot_retries=4

   Copy to Clipboard Toggle word wrap

   Example:

   [root@ip-10-0-0-48 ~]# pcs stonith \
   create clusterfence fence_aws access_key=AKIAI123456MRMJA secret_key=a75EYIG4RVL3hdsdAslK7koQ8dzaDyn5yoIZ/ \
   region=us-east-1 pcmk_host_map="ip-10-0-0-48:i-07f1ac63af0ec0ac6;ip-10-0-0-46:i-063fc5fe93b4167b2;ip-10-0-0-58:i-08bd39eb03a6fd2c7" \
   power_timeout=240 pcmk_reboot_timeout=480 pcmk_reboot_retries=4

   Copy to Clipboard Toggle word wrap
3. To ensure immediate and complete fencing, disable ACPI Soft-Off on all cluster nodes. For information about disabling ACPI Soft-Off, see Disabling ACPI for use with integrated fence device.

Alternate procedure

1. Obtain the VPC ID of the cluster.

   # aws ec2 describe-vpcs --output text --filters "Name=tag:Name,Values=<clustername>-vpc" --query 'Vpcs[*].VpcId'
   vpc-06bc10ac8f6006664

   Copy to Clipboard Toggle word wrap

2. By using the VPC ID of the cluster, obtain the VPC instances.

   $ aws ec2 describe-instances --output text --filters "Name=vpc-id,Values=vpc-06bc10ac8f6006664" --query 'Reservations[*].Instances[*].{Name:Tags[? Key==Name]|[0].Value,Instance:InstanceId}' | grep "\-node[a-c]"
   i-0b02af8927a895137     <clustername>-nodea-vm
   i-0cceb4ba8ab743b69     <clustername>-nodeb-vm
   i-0502291ab38c762a5     <clustername>-nodec-vm

   Copy to Clipboard Toggle word wrap

3. Use the obtained instance IDs to configure fencing on each node on the cluster. For example, to configure a fencing device on all nodes in a cluster:

   [root@nodea ~]# CLUSTER=<clustername> && pcs stonith create fence${CLUSTER} fence_aws access_key=XXXXXXXXXXXXXXXXXXXX pcmk_host_map=$(for NODE \
   in node{a..c}; do ssh ${NODE} "echo -n \${HOSTNAME}:\$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\;"; done) \
   pcmk_reboot_retries=4 pcmk_reboot_timeout=480 power_timeout=240 region=xx-xxxx-x secret_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

   Copy to Clipboard Toggle word wrap

   For information about specific parameters for creating fencing devices, see the fence_aws man page or the Configuring and managing high availability clusters guide.

4. To ensure immediate and complete fencing, disable ACPI Soft-Off on all cluster nodes. For information about disabling ACPI Soft-Off, see Disabling ACPI for use with integrated fence device.

Verification

1. Display the configured fencing devices and their parameters on your nodes:

   [root@nodea ~]# pcs stonith config fence${CLUSTER}
   
   Resource: <clustername> (class=stonith type=fence_aws)
   Attributes: access_key=XXXXXXXXXXXXXXXXXXXX pcmk_host_map=nodea:i-0b02af8927a895137;nodeb:i-0cceb4ba8ab743b69;nodec:i-0502291ab38c762a5;
   pcmk_reboot_retries=4 pcmk_reboot_timeout=480 power_timeout=240 region=xx-xxxx-x secret_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   Operations: monitor interval=60s (<clustername>-monitor-interval-60s)

   Copy to Clipboard Toggle word wrap

2. Test the fencing agent for one of the cluster nodes.

   # pcs stonith fence <awsnodename>

   Copy to Clipboard Toggle word wrap
   Note

   The command response may take several minutes to display. If you watch the active terminal session for the node being fenced, you see that the terminal connection is immediately terminated after you enter the fence command.

   Example:

   [root@ip-10-0-0-48 ~]# pcs stonith fence ip-10-0-0-58
   
   Node: ip-10-0-0-58 fenced

   Copy to Clipboard Toggle word wrap

3. Check the status to verify that the node is fenced.

   # pcs status

   Copy to Clipboard Toggle word wrap

   Example:

   [root@ip-10-0-0-48 ~]# pcs status
   
   Cluster name: newcluster
   Stack: corosync
   Current DC: ip-10-0-0-46 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum
   Last updated: Fri Mar  2 19:55:41 2018
   Last change: Fri Mar  2 19:24:59 2018 by root via cibadmin on ip-10-0-0-46
   
   3 nodes configured
   1 resource configured
   
   Online: [ ip-10-0-0-46 ip-10-0-0-48 ]
   OFFLINE: [ ip-10-0-0-58 ]
   
   Full list of resources:
   clusterfence  (stonith:fence_aws):    Started ip-10-0-0-46
   
   Daemon Status:
   corosync: active/disabled
   pacemaker: active/disabled
   pcsd: active/enabled

   Copy to Clipboard Toggle word wrap

4. Start the node that was fenced in the previous step.

   # pcs cluster start <awshostname>

   Copy to Clipboard Toggle word wrap

5. Check the status to verify the node started.

   # pcs status

   Copy to Clipboard Toggle word wrap

   Example:

   [root@ip-10-0-0-48 ~]# pcs status
   
   Cluster name: newcluster
   Stack: corosync
   Current DC: ip-10-0-0-46 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum
   Last updated: Fri Mar  2 20:01:31 2018
   Last change: Fri Mar  2 19:24:59 2018 by root via cibadmin on ip-10-0-0-48
   
   3 nodes configured
   1 resource configured
   
   Online: [ ip-10-0-0-46 ip-10-0-0-48 ip-10-0-0-58 ]
   
   Full list of resources:
   
     clusterfence  (stonith:fence_aws):    Started ip-10-0-0-46
   
   Daemon Status:
     corosync: active/disabled
     pacemaker: active/disabled
     pcsd: active/enabled

   Copy to Clipboard Toggle word wrap

Procedure

1. Install the AWS CLI. For instructions, see Installing the AWS CLI.

2. Verify that the AWS CLI is configured properly. The instance IDs and instance names should display.

   Example:

   [root@ip-10-0-0-48 ~]# aws ec2 describe-instances --output text --query 'Reservations[*].Instances[*].[InstanceId,Tags[?Key==Name].Value]'
   i-07f1ac63af0ec0ac6
   ip-10-0-0-48
   i-063fc5fe93b4167b2
   ip-10-0-0-46
   i-08bd39eb03a6fd2c7
   ip-10-0-0-58

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a shared block volume by using the AWS command create-volume.

   $ aws ec2 create-volume --availability-zone <availability_zone> --no-encrypted --size 1024 --volume-type io1 --iops 51200 --multi-attach-enabled

   Copy to Clipboard Toggle word wrap

   For example, the following command creates a volume in the us-east-1a availability zone.

   $ aws ec2 create-volume --availability-zone us-east-1a --no-encrypted --size 1024 --volume-type io1 --iops 51200 --multi-attach-enabled
   
   {
       "AvailabilityZone": "us-east-1a",
       "CreateTime": "2020-08-27T19:16:42.000Z",
       "Encrypted": false,
       "Size": 1024,
       "SnapshotId": "",
       "State": "creating",
       "VolumeId": "vol-042a5652867304f09",
       "Iops": 51200,
       "Tags": [ ],
       "VolumeType": "io1"
   }

   Copy to Clipboard Toggle word wrap
   Note

   You need the VolumeId in the next step.

2. For each instance in your cluster, attach a shared block volume by using the AWS command attach-volume. Use your <instance_id> and <volume_id>.

   $ aws ec2 attach-volume --device /dev/xvdd --instance-id <instance_id> --volume-id <volume_id>

   Copy to Clipboard Toggle word wrap

   For example, the following command attaches a shared block volume vol-042a5652867304f09 to instance i-0eb803361c2c887f2.

   $ aws ec2 attach-volume --device /dev/xvdd --instance-id i-0eb803361c2c887f2 --volume-id vol-042a5652867304f09
   
   {
       "AttachTime": "2020-08-27T19:26:16.086Z",
       "Device": "/dev/xvdd",
       "InstanceId": "i-0eb803361c2c887f2",
       "State": "attaching",
       "VolumeId": "vol-042a5652867304f09"
   }

   Copy to Clipboard Toggle word wrap

Verification

1. For each instance in your cluster, verify that the block device is available by using the ssh command with your instance <ip_address>.

   # ssh <ip_address> "hostname ; lsblk -d | grep ' 1T '"

   Copy to Clipboard Toggle word wrap

   For example, the following command lists details including the host name and block device for the instance IP 198.51.100.3.

   # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T '"
   
   nodea
   nvme2n1 259:1    0   1T  0 disk

   Copy to Clipboard Toggle word wrap

2. Use the ssh command to verify that each instance in your cluster uses the same shared disk.

   # ssh <ip_address> "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"

   Copy to Clipboard Toggle word wrap

   For example, the following command lists details including the host name and shared disk volume ID for the instance IP address 198.51.100.3.

   # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"
   
   nodea
   E: ID_SERIAL=Amazon Elastic Block Store_vol0fa5342e7aedf09f7

   Copy to Clipboard Toggle word wrap

1. A receiver collects telemetry data from data sources, such as applications and services.
2. After the receiver ingest data, it passes to a processing phase, in which a chain of processors may be defined to transform the data.
3. The exporter sends the telemetry data to the required destination.

Procedure

1. Install the opentelemetry-collector package on a RHEL instance:

   # dnf install -y opentelemetry-collector

   Copy to Clipboard Toggle word wrap

2. Enable and start the service to transfer the logs from the RHEL instance to AWS CloudWatch Logs:

   # systemctl enable --now opentelemetry-collector.service

   Copy to Clipboard Toggle word wrap

3. To configure the OTel Collector to forward journald logs from the RHEL instance, create and edit the /etc/opentelemetry-collector/configs/10-cloudwatch-exporter.yaml file:

   ...
   exporters:
     awscloudwatchlogs:
       log_group_name: testing-logs-emf
       log_stream_name: testing-integrations-stream-emf
       raw_log: true
       region: us-east-1
       endpoint: logs.us-east-1.amazonaws.com
       log_retention: 365
       tags:
         sampleKey: sampleValue
   service:
     pipelines:
       logs:
         receivers:
           - journald
         exporters:
           - awscloudwatchlogs
   ...

   Copy to Clipboard Toggle word wrap

4. Restart the OTel Collector service:

   # systemctl restart opentelemetry-collector.service

   Copy to Clipboard Toggle word wrap
5. Create an IAM role for AWS CloudWatch agent from AWS console. For instructions, see Create IAM roles and users for use with the CloudWatch agent.
6. Attach the role to the RHEL instance through AWS Console. For instructions, see Attach an IAM role to an instance.
7. Restart the RHEL instance from AWS console to enable log exportation automatically.

8. Optional: If you no longer want to export logs, stop logs transfer from the RHEL instance:

   # systemctl stop opentelemetry-collector.service

   Copy to Clipboard Toggle word wrap

9. Optional: If you no longer need this service, permanently disable logs transfer:

   # systemctl disable opentelemetry-collector.service

   Copy to Clipboard Toggle word wrap

Prerequisites

1. The RHEL AMI has the uefi-preferred option enabled in boot settings:

   $ aws ec2 describe-images --image-id <ami-099f85fc24d27c2a7> --region <us-east-2> | grep -E '"ImageId"|"Name"|"BootMode"'
   
   "ImageId": "ami-099f85fc24d27c2a7",
   "Name": "RHEL-9.6.0_HVM_GA-20250423-x86_64-0-Hourly2-GP3",
   "BootMode": "uefi-preferred"

   Copy to Clipboard Toggle word wrap

2. You have installed the following packages on the RHEL instance:

   • awscli2
   • python3
   • openssl
   • efivar
   • keyutils
   • edk2-ovmf
   • python3-virt-firmware

Procedure

1. Check the platform status of the RHEL Marketplace AMI instance:

   $ mokutil --sb-state
   
   SecureBoot disabled
   Platform is in Setup Mode

   Copy to Clipboard Toggle word wrap

   The setup mode allows updating the Secure Boot UEFI variables within the instance.

2. Create a new random universally unique identifier (UUID) and store it in a system-generated text file:

   $ uuidgen --random > GUID.txt

   Copy to Clipboard Toggle word wrap

3. Generate a new PK.key RSA private key and a self-signed PK.cer X.509 certificate for the Platform Key database:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout PK.key \
   -new -x509 -sha256 \
   -days 3650 \
   -subj "/CN=Platform key/" \
   -outform DER -out PK.cer

   Copy to Clipboard Toggle word wrap

   The openssl utility generates a common name Platform key for the certificate by setting output format to Distinguished Encoding Rules (DER).

4. Generate a new KEK.key RSA private key and a self-signed KEK.cer X.509 certificate for the Key Exchange Key database:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout KEK.key \
   -new -x509 -sha256 \
   -days 3650 \
   -subj "CN=Key Exchange Key/" \
   -outform DER -out KEK.cer

   Copy to Clipboard Toggle word wrap

5. Generate a custom_db.cer custom certificate:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout custom_db.key \
   -new -x509 -sha256 \
   -days 3650 \
   -subj "/CN=Signature Database key/" \
   --outform DER -out custom_db.cer

   Copy to Clipboard Toggle word wrap

6. Download the Microsoft Corporation UEFI CA 2011 Certificate:

   $ wget https://go.microsoft.com/fwlink/p/?linkid=321194 --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" -O MicCorUEFCA2011_2011-06-27.crt

   Copy to Clipboard Toggle word wrap

7. Download the updated UEFI Revocation List File of forbidden signatures (dbx) for x64 bits system:

   $ wget https://uefi.org/sites/default/files/resources/x64_DBXUpdate.bin

   Copy to Clipboard Toggle word wrap

8. Generate UEFI variables file using the virt-fw-vars utility:

   $ virt-fw-vars --set-pk "$(< GUID.txt)" PK.cer \
   --add-kek "$(< GUID.txt)" KEK.cer \
   --add-db "$(< GUID.txt)" custom_db.cer \
   --add-db 77fa9abd-0359-4d32-bd60-28f4e78f784b MicCorUEFCA2011_2011-06-27.crt \
   --set-dbx DBXUpdate.bin -i /usr/share/edk2/ovmf/OVMF_VARS.secboot.fd \
   --output VARS

   Copy to Clipboard Toggle word wrap

   For details on the virt-fw-vars utility, see the virt-fw-vars(1) man page on the system.

9. Convert UEFI variables to the Extensible Firmware Interface (EFI) Signature List (ESL) format:

   $ python3 /usr/share/doc/python3-virt-firmware/experimental/authfiles.py \
   --input VARS \
   --outdir .
   $ for f in PK KEK db dbx; do tail -c +41 $f.auth > $f.esl; done

   Copy to Clipboard Toggle word wrap
   Note

   Each GUID is an assigned value and represents an EFI parameter

   • 8be4df61-93ca-11d2-aa0d-00e098032b8c: EFI_GLOBAL_VARIABLE_GUID
   • d719b2cb-3d3a-4596-a3bc-dad00e67656f: EFI_IMAGE_SECURITY_DATABASE_GUID

   The EFI_GLOBAL_VARIABLE_GUID parameter maintains settings of the bootable devices and boot managers, while the EFI_IMAGE_SECURITY_DATABASE_GUID parameter represents the image security database for Secure Boot variables db, dbx, and storage of required keys and certificates.

10. Transfer the database certificates to the target instance, use the efivar utility to manage UEFI environment variables.

    1. To transfer PK.esl, enter:

       # efivar -w -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-PK -f PK.esl

       Copy to Clipboard Toggle word wrap

    2. To transfer KEK.esl, enter:

       # efivar -w -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-KEK -f KEK.esl

       Copy to Clipboard Toggle word wrap

    3. To transfer db.esl, enter:

       # efivar -w -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-db -f db.esl

       Copy to Clipboard Toggle word wrap

    4. To transfer the dbx.esl UEFI revocation list file for x64 architecture, enter:

       # efivar -w -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-dbx -f dbx.esl

       Copy to Clipboard Toggle word wrap
11. Reboot the instance from the AWS console.

Verification

1. Verify if Secure Boot is enabled:

   $ mokutil --sb-state
   
   SecureBoot enabled

   Copy to Clipboard Toggle word wrap

2. Use the keyctl utility to verify the kernel keyring for the custom certificate:

   $ sudo keyctl list %:.platform
   
   4 keys in keyring:
   907254483: ---lswrv     0     0 asymmetric: Signature Database key: f064979641c24e1b935e402bdbc3d5c4672a1acc
   ...

   Copy to Clipboard Toggle word wrap

Prerequisites

1. You have created and uploaded an AWS AMI image. For details, see Creating and uploading AWS AMI.

2. You have installed the following packages:

   • awscli2
   • python3
   • openssl
   • efivar
   • keyutils
   • python3-virt-firmware

Procedure

1. Create a new random universally unique identifier (UUID) and store it in a system-generated text file:

   $ uuidgen --random > GUID.txt

   Copy to Clipboard Toggle word wrap

2. Generate a new RSA private key PK.key and a self-signed X.509 certificate PK.cer for the platform Key database:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout PK.key \
   -new -x509 -sha256 \
   -days 3650 \
   -outform DER -out PK.cer

   Copy to Clipboard Toggle word wrap

   The openssl utility generates a common name platform key for the certificate by setting output format to Distinguished Encoding Rules (DER).

3. Generate a new RSA private key KEK.key and a self-signed X.509 certificate KEK.cer for the Key Exchange Key database:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout KEK.key \
   -new -x509 -sha256 \
   -days 3650 \
   -subj "/CN=Key Exchange Key/" \
   -outform DER -out KEK.cer

   Copy to Clipboard Toggle word wrap

4. Generate a custom certificate custom_db.cer:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout custom_db.key \
   -new -x509 -sha256 \
   -days 3650 -subj "/CN=Signature Database key/" \
   --outform DER -out custom_db.cer

   Copy to Clipboard Toggle word wrap

5. Download the updated UEFI Revocation List File of forbidden signatures (dbx) for 64 bit system:

   $ wget https://uefi.org/sites/default/files/resources/x64_DBXUpdate.bin

   Copy to Clipboard Toggle word wrap

6. Use the virt-fw-vars utility to generate the aws_blob.bin binary file from keys, database certificates, and the UEFI variable store:

   $ virt-fw-vars --output-aws aws_blob.bin \
   --set-pk "$(< GUID.txt)" PK.cer \
   --add-kek "$(< GUID.txt)" KEK.cer \
   --add-db "$(< GUID.txt)" custom_db.cer \
   --add-db 77fa9abd-0359-4d32-bd60-28f4e78f784b MicCorUEFCA2011_2011-06-27.crt \
   --set-dbx x64_DBXUpdate.bin

   Copy to Clipboard Toggle word wrap

   The customized blob consists of:

   • PK.cer with a self-signed X.509 certificate
   • KEK.cer and custom_db.cer with owner group GUID and Privacy Enhanced Mail (pem) format
   • x64_DBXUpdate.bin list downloaded from database of excluded signatures (dbx).
   • The 77fa9abd-0359-4d32-bd60-28f4e78f784b UUID is for MicCorUEFCA2011_2011-06-27.crt Microsoft Corporation UEFI Certification Authority 2011.

7. Use the awscli2 utility to create and register the AMI from a disk snapshot with the required Secure Boot variables:

   $ aws ec2 register-image \
   --name rhel9-example-ami \
   --architecture x86_64 \
   --virtualization-type hvm \
   --root-device-name "/dev/sda1" \
   --block-device-mappings "{\"DeviceName\": \"/dev/sda1\",\"Ebs\": {\"SnapshotId\": \"snap-example-id\"}}" \
   --ena-support --boot-mode uefi \
   --region eu-central-1 \
   --uefi-data $(cat aws_blob.bin)

   Copy to Clipboard Toggle word wrap
8. Reboot the instance from the AWS Console.

Verification

1. Verify if Secure Boot is enabled:

   $ mokutil --sb-state
   SecureBoot enabled

   Copy to Clipboard Toggle word wrap

2. Use the keyctl utility to verify the kernel keyring for the custom certificate:

   $ sudo keyctl list %:.platform
   
   4 keys in keyring:
   907254483: ---lswrv     0     0 asymmetric: Signature Database key: f064979641c24e1b935e402bdbc3d5c4672a1acc
   ...

   Copy to Clipboard Toggle word wrap