How do I upgrade or repair storage and network AWS drivers on an EC2 Windows instance?

Short description

You can use three types of AWS drivers on Amazon EC2 Windows instances:

• Paravirtual (PV) drivers
• AWS non-volatile memory express (NVMe) drivers
• Elastic Network Adapter (ENA) drivers

The type of AWS driver that you use depends on the instance type. Most Nitro-based instances use the ENA driver for networking and the AWS NVMe driver for storage. Most Xen-based instances use the AWS PV driver for both network and storage. Some instances use a combination of drivers for storage and networking.

To identify the underlying hypervisor (Nitro or Xen) of the specific instance type, review the tables defined in Amazon EC2 instance type specifications. And then, identify which networking and storage AWS drivers needs to be installed on it.

Note: AWS PV drivers are supported on Windows Server 2008 R2 and later. Windows Server 2003 uses Citrix PV drivers. Windows Server 2008 R2 supports AWS PV version 8.3.4 and earlier and AWS ENA 2.2.3 and earlier. For more information, see Paravirtual drivers for Windows instances.

For more upgrade information, see Migrate an EC2 Windows instance to a Nitro-based instance type.

Note: To list the AWS drivers and driver versions that run on your Windows instance, run the following Windows PowerShell command. If your instance is Nitro-based, then the following command shows the currently installed ENA and NVMe driver version in the output. If your instance is Xen-based, then the following command shows the currently installed PV driver version in the output:

Get-WmiObject Win32_PnpSignedDriver | Select-Object DeviceName, DriverVersion, InfName | Where-Object {$_.DeviceName -like "*AWS*" -OR $_.DeviceName -like "*Amazon*"}

Resolution

Complete the following resolution tasks:

Use the SSM Automation runbook to upgrade AWS drivers

The AWSSupport-UpgradeWindowsAWSDrivers runbook uses the SSM Agent to install the latest AWS drivers. If the runbook can't contact the SSM Agent, then the runbook installs the drivers offline, if requested.

Note: Both the online and offline upgrades create an Amazon Machine Image (AMI) before the installation starts. This AMI persists after the runbook completes installation. You must secure access to the AMI or delete it. The online method restarts the target instance as part of the upgrade process. For the offline method, you must stop and start the EC2 instance.

Prerequisites:

• Make sure that your AWS Identity and Access Management (IAM) user or role has the permissions listed in required IAM permissions.
• Use the runbook in only the us-east-1 AWS Region when Amazon Virtual Private Cloud (Amazon VPC) endpoints are used to connect to AWS Systems Manager. If the instance uses an internet or transit gateway to connect to Systems Manager without VPC endpoints, then the runbook works in all AWS Regions.
• This runbook fails on a domain controller. To update AWS PV drivers on a domain controller, see Upgrade a domain controller (AWS PV upgrade).

Run the AWSSupport-UpgradeWindowsAWSDrivers runbook

Complete the following steps:

1. Open the Systems Manager console.
2. In the navigation pane, choose Documents.
3. In the search bar, enter AWSSupport-UpgradeWindowsAWSDrivers.
4. Select the AWSSupport-UpgradeWindowsAWSDrivers document.
5. Choose Execute automation.
6. Enter the following input parameters:
   (Optional) AllowOffline. To install the drivers offline if the online installation fails, set this value to True.
   Note: The offline method requires a stop and start of the EC2 instance. Data stored in instance store volumes is lost when the instance is stopped. If you don't use an Elastic IP address, then the public IP address changes. For more information, see Stop and start Amazon EC2 instances.
   (Optional) AutomationAssumeRole. Enter the ARN of the IAM role that allows Automation to perform actions for you. If a role isn't specified, then Automation uses the permissions of the user that starts the runbook.
   (Optional) ForceUpgrade. Set this value to True to allow the offline drivers upgrade to proceed even though your instance already has the latest drivers.
   InstanceId. Enter the instance ID of your EC2 instance for Windows Server.
   (Optional) SubnetId. For offline installation, enter the subnet ID for the rescue instance used to perform the offline drivers upgrade. If a subnet ID isn't specified, then Automation creates a new VPC to act as the rescue instance.
7. Required IAM permissions. The target EC2 instance must have an IAM role that includes the following permissions.
   Note: It's a best practice to use the Automation IAM role AmazonSSMAutomationRole to run this automation. To provide these permissions, attach the AmazonSSMManagedInstanceCore Amazon managed policy to your IAM role. For more information, see Create the service roles for Automation using the console.
   ssm:StartAutomationExecution. This permission runs the automation.
   ssm:SendCommand. This permission sends the command to the target instance.
   ssm:GetAutomationExecution. This permission reads the automation output.
8. Choose Execute. The runbook performs the following steps:
   aws:assertAwsResourceProperty. Verifies that the input instance is a Windows instance.
   aws:assertAwsResourceProperty. Verifies that the input instance is a managed instance. If it's a managed instance, then the online upgrade starts. If it's not a managed instance, then the offline upgrade is evaluated.

Note: To help you troubleshoot, manage, and reduce costs on your AWS resources, AWS Support maintains a subset of the Systems Manager provided predefined runbooks. These runbooks are prefixed with "AWSSupport-" or "AWSPremiumSupport-."

Manually install or upgrade your Windows EC2 instance

Note: It's a best practice to manually install the AWS drivers on Production Servers during the server's downtime because AWS drivers Installation requires a reboot. Also, take the appropriate backup of the server in the form of AMI or Snapshot before the drivers installation.

PV drivers

To install or upgrade AWS PV drivers, Citrix PV drivers, and Red Hat PV drivers, see Paravirtual drivers for Windows instances.

AWS NVMe drivers

To install or upgrade AWS NVMe drivers, see AWS NVMe drivers.

ENA drivers

To install ENA drivers, see Enable enhanced networking with ENA on your EC2 instances. For the Intel 82599 VF interface, see Enhanced networking with the Intel 82599 VF interface.

Related information

Run an automated operation powered by Systems Manager Automation

Setting up Automation

AWS Support Automation Workflows (SAW)

How can I troubleshoot an EC2 Windows instance that is unreachable or can't reach the DNS after upgrading the drivers?

Troubleshoot PV drivers on Windows instances