I have frequently been asked how to manually import on-premises virtual machines into AWS, without using other services such as CloudEndure or AWS Migration Services. Some organizations may want a quick and dirty way to get the source to the destination without spinning up any extra appliances, going through Change Control, or just getting to the end goal faster compared to the extra layers offered by other services.

VM Import/Export enables you to import virtual machine images from your existing virtualization environment (VMware, Hyper-V, etc.) to Amazon EC2. This enables you to migrate applications and workloads to Amazon EC2, copy your VM image to Amazon EC2 or create a repository of VM images for backup and disaster recovery. As there are other services to do the heavy lifting, this article will shed light on what it takes to convert an on-premises virtual machine to AWS as an Amazon Machine Image (AMI).

Pre-Requisites for VMware Image:

1. Remove VMware tools if installed.
   
2. Disable AV or IDS applications.
3. Disconnect CD-ROM drives.
4. Enable DHCP.
5. Enable RDP and modify OS firewall rules to allow RDP.
6. Install .NET Framework 4.5 or later.

Silent Install:

To silently install AWS CLI on a computer with internet access:

1. Open PowerShell.
2. Run msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi /q .

Confirm:

To confirm AWS CLI has been successfully installed:

1. Open PowerShell.
2. Run AWS---version
3. Output should show the version that was installed.

AWS Profile:

To create your AWS profile with your secret key and secret access key:

1. Open PowerShell.
2. Run AWS configure
3. Input your secret key and press enter.
4. Input your secret access key and press enter.
5. Input your default location, “us-east-1” as an example, and press enter.
6. Input your format, JSON as an example.

To confirm your AWS profile was saved:

1. Open PowerShell.
2. Run: cat c:\users\<your login name>\.aws\config and press enter.
   a. This will show general properties for your default profile.
3.  Run: cat c:\users\<your login name>\.aws\credentials and press enter.
   a. This will show your credentials, which includes your secret key and secret access key.

In order to save the vmdk (or vhd) file for your virtual machine, you will need to create a bucket in AWS. Each bucket has to be unique across all of AWS (not just your account) and has to be in lowercase.

To Create a Bucket

1. Open Powershell.
2. Run aws s3 mb s3://nameofmybucket/import .
   a. nameofmybucket is an example name; please substitute for something unique to you.
   b. /import is a ’folder’ (S3 doesn't really do folders, but that is another discussion) in the 'nameofmybucket' bucket; this will be the location of the virtual machine file.

Copy to Bucket:

1. Open PowerShell.
2. Browse to the location of your vmdk file.
3. Run: aws s3 cp 'locationOfvirtualMachineFolder\2019.vmdk' s3://nameofmybucket/import/ .
4. Wait for the file to finish uploading.

Import Roles and Policies

In order for the import service to work properly, certain permissions must be created for the service. Three files will be created for this task:

1. containers.json – this file contains the location of your vmdk file in AWS S3. You can use vmdk, vhd, ovf files.
2. trust-policy.json – this file provides the VM import service to assume the role for your account.
3. role-policy.json – this file provides the permissions to access the S3 bucket holding your vmdk file, which will be linked to a role.

Code

1. Create a file called containers.json and copy and paste the contents below into that file, changing the contents of the bold entries to match yours:

[{

   "Description": "First CLI task",

   "Format": "vmdk",

   "UserBucket": {

       "S3Bucket": "name of your bucket",

       "S3Key": "import/name of the vmdk file"

   }

}]

2. Create a file called trust-policy.json and copy and paste the contents below into that file

#trust-policy.json

{

  "Version": "2012-10-17",

  "Statement": [

     {

        "Effect": "Allow",

        "Principal": { "Service": "vmie.amazonaws.com" },

        "Action": "sts:AssumeRole",

        "Condition": {

           "StringEquals":{

              "sts:Externalid": "vmimport"

           }

        }

     }

  ]

}

3. Create a file called role-policy.json and copy and paste the contents below into that file, changing the contents of the bold entries to match yours:

{

  "Version":"2012-10-17",

  "Statement":[

     {

        "Effect": "Allow",

        "Action": [

           "s3:GetBucketLocation",

           "s3:GetObject",

           "s3:ListBucket"

        ],

        "Resource": [

           "arn:aws:s3:::637619337672416743/import",

           "arn:aws:s3:::637619337672416743/import/*"

        ]

     },

     {

        "Effect": "Allow",

        "Action": [

           "s3:GetBucketLocation",

           "s3:GetObject",

           "s3:ListBucket",

           "s3:PutObject",

           "s3:GetBucketAcl"

        ]

}

Roles

Create roles based on the files you created above:

1. Open PowerShell.
2. Browse to the location of the files above.
3. Run: aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json .
4. Run: aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json .

Import VMDK to AMI

1. Open PowerShell.
2. Run: aws ec2 import-image --description "Windows 2008 VHD" --license-type BYOL --disk-containers file://containers.json .
3. The above will provide you with a task-id, which you can use to view the status/progress:
4. In PowerShell run (replace highlighted with the ID you are provided from above): aws ec2 describe-import-image-tasks --import-task-ids import-ami-1234567890abcdef0 .

Launch AMI

Once the conversion is complete, you can:

1. Log into the AWS Console.
2. Near the top, search for EC2 and click on the link shown to head to the EC2 administration console.
3. Click on Launch Instance.
4. Select My AMIs from the left pane.
5. Find your AMI and click on Select.
6. Continue on as with any EC2 provisioning picking the specs, subnets, security groups, etc.

Arun Daniel is a Sr. Consulting Engineer for Data Center and Cloud Services at CDW with more than 20 years of experience designing, deploying and managing all aspects of data center and cloud services. For the past 10 years, his primary focus has been migrations from on-premises data centers to Amazon Web Services. Arun holds numerous AWS certifications, as well as HashiCorp, Microsoft Azure, VMware and Cisco certifications.