You can export an AWS AMI as a VMDK file using the AWS VM Import/Export service. This process involves exporting the AMI to an Amazon S3 bucket, from where you can then download the VMDK file.
Here's a detailed breakdown of the steps and important considerations:
1. Prerequisites and Limitations:
Before you start, be aware of these crucial points:
- AWS CLI: You'll primarily use the AWS Command Line Interface (CLI) for this process, as it's the most common and robust way to manage VM Import/Export tasks. Ensure you have it installed and configured with appropriate AWS credentials.
- S3 Bucket: You need an Amazon S3 bucket in the same AWS Region as your AMI to store the exported VMDK file.
- IAM Role (vmimport): AWS VM Import/Export requires an IAM service role (typically named
vmimport) with the necessary permissions to read from and write to your S3 bucket. If you don't have this, you'll need to create it. AWS documentation provides the required trust policy and permissions.
- AMI Export Limitations:
- Not all AMIs can be exported. You generally cannot export AMIs that contain third-party software provided by AWS (e.g., Windows or SQL Server images, or any AMI from the AWS Marketplace), unless they were originally imported as "Bring Your Own License" (BYOL) through VM Import/Export or AWS Application Migration Service (MGN)/AWS Elastic Disaster Recovery (AWS DRS).
- You cannot export an AMI with encrypted EBS snapshots.
- VMs with volumes larger than 1 TiB might have limitations (though for larger disks, you might need a manifest file).
- You can't export an AMI if you've shared it from another AWS account.
- You can't have multiple export image tasks in progress for the same AMI simultaneously.
- Volumes attached after instance launch are not exported; only those specified in the AMI's block device mapping are included.
- Consistent AMI: For the best results, ensure your AMI was created from a stopped instance or an application-consistent snapshot to avoid data corruption in the exported VMDK.
2. Steps to Export the AMI as VMDK:
a. Create an S3 Bucket (if you don't have one):
You can do this via the AWS Management Console or AWS CLI.
AWS Console:
- Go to the S3 service.
- Click "Create bucket."
- Provide a unique bucket name.
- Choose the same AWS Region as your AMI.
- Keep "Block all public access" enabled unless you have a specific reason to disable it (and understand the security implications).
- Click "Create bucket."
AWS CLI:
b. Create the IAM Role (if you don't have one):
This is crucial for allowing AWS VM Import/Export to interact with your S3 bucket.
- Create a trust policy file (
trust-policy.json):
2.1 Create the IAM role (vmimport):
bash aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json
3. Create an inline policy file (role-policy.json):
Replace your-export-bucket-name with your actual bucket name.
json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::your-export-bucket-name", "arn:aws:s3:::your-export-bucket-name/*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::your-export-bucket-name", "arn:aws:s3:::your-export-bucket-name/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeTags", "ec2:CreateTags" ], "Resource": "*" } ] }
4. Attach the inline policy to the vmimport role:
bash aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json
c. Start the Export Image Task:
Use the export-image command with the AWS CLI.
- Replace
ami-0123456789abcdef0 with the actual ID of your AMI.
- Replace
your-export-bucket-name with the name of your S3 bucket.
S3Prefix=exports/ is optional but good practice to organize your exported files within the bucket.--disk-image-format VMDK specifies the output format. You can also choose VHD or RAW.
d. Monitor the Export Task:
The export process can take some time, depending on the size of your AMI. You can check the status using the describe-export-image-tasks command:
The Status field will show the progress (e.g., active, completed, deleting, deleted). Wait until the status changes to completed.
and entering the access key and secret key (which PB had to generate and give me).
Then, we could log in, and as prompted by chatgpt, modify the cloud-init file - copy-pasting below -
line which needed to be commented out. Then,
In this case, we tested the VM with NAT networking, with port forwarding set on Virtualbox Settings - Network - 2244 for ssh, 8080 for 80, 8443 for 443.
