EC2 Instance created from AMI in another Account is missing Internet connectivity

Question

Hi there.

We use AWS Organizations which has a few AWS Accounts. I have tried to create an EC2 Instance in Account "B" using an AMI shared from Account "A". The EC2 instance was created within the same region, but in a different VPC. However, I'm facing a problem that EC2 instance hasn't internet connectivity. Image below illustrate this. The screenshot was taken from the Windows EC2 instance, clicking on "Get instance screenshot" option.
![Windows Instance without internet connectivity](/media/postImages/original/IM9IqNfqfbSTOxMnbVIbyP_Q)

I have tried few scenarios, but none of them worked. The scenarios which I tried are:
* Create EC2 Instance in Account "B" using different IPV4 from EC2 Instance used to create the AMI.
* Create EC2 Instance in Account "B" using the same IPV4 as EC2 Instance used to create the AMI.

For knowledge, Internet routing, NACLs and Security Groups are correctly configured in Account "B". Furthermore, EC2 instance hosted on Account "A" hadn't any Internet connectivity issue at the moment when AMI was created. Below, has another list of scenarios also tried for test purpose.
* Create EC2 Instance in Account "B" using an AWS Managed AMI Windows Server 2022 Base. It worked successfully.
* Create EC2 Instance in Account "B" using a different AMI shared from Account "A". It doesn't work.
* Create EC2 Instance in Account "A" using the AMI that we were using to create EC2 Instance in Account "B". It also worked successfully.

I believe that has an issue related to AMI sharing. Do you imagine which could be the reason for this problem?

Vitor · Accepted Answer

Hi there.

After a lot of tests and researches, I understood the main problem. The EC2 Instance used as AMI Source was configured with Static IP address into Operating System Network configurations. It is a problem working with AMI. AWS recommends don't use Static IP when going to create an AMI. So, since that Source EC2 has a production workload and there is a requirement having Static IP Address configured to Network Interfaces, the AMI was taken from Production EC2 (in account "A") without any changes at Operating System level. But, at the moment of EC2 launch in Account "B" using created AMI, we specified a PowerShell Script into UserData field.

The PowerShell Script used to solve this problem follow below.
```

Set-NetIPInterface -InterfaceAlias "Ethernet" -Dhcp Enabled
Start-Sleep -Seconds 5
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ResetServerAddresses
 
```

Script above reconfigure the Network Interface to receive the IP by DHCP and reset DNS Server IP.
Specifying this script in UserData field, we solve our problem.

re:Post Agent · Answer

When you create an EC2 instance from a shared AMI in a different account and VPC, several network configuration settings from the original instance might be preserved in the AMI, which can cause connectivity issues. Here are the likely causes and solutions for your internet connectivity problem:

1. **Network Configuration Persistence**: The Windows instance might have network settings from the original environment (Account A) that are conflicting with the new environment (Account B). This includes saved network adapter configurations, static IP addresses, DNS settings, or proxy configurations.

2. **Windows Firewall Settings**: The Windows Firewall settings from the original instance might be blocking outbound internet traffic in the new environment.

3. **Route Table Configuration**: Even though you mentioned that internet routing is correctly configured, double-check that the subnet where your instance resides has a route to an Internet Gateway (0.0.0.0/0 pointing to an IGW).

4. **Public IP Assignment**: Verify that your EC2 instance has a public IP address assigned to it. Without a public IP, the instance won't be able to communicate with the internet even if the VPC has an Internet Gateway.

5. **VPC and Subnet Settings**: Ensure that the subnet is a public subnet with proper route table associations.

To resolve this issue:

1. Reset the network configuration on the Windows instance:
- Connect to the instance using EC2 Instance Connect or Systems Manager Session Manager
- Reset TCP/IP stack using "netsh int ip reset"
- Release and renew IP address using "ipconfig /release" followed by "ipconfig /renew"
- Reset Windows Firewall to default settings

2. If the instance still can't connect to the internet, try stopping and starting the instance (not just rebooting) which will migrate it to a new host and might resolve networking issues.

3. As a last resort, you might need to create a new AMI in Account A with more generalized network settings before sharing it with Account B.

Since your test with an AWS Managed AMI worked successfully in Account B, this confirms that the issue is specific to the shared AMI rather than your VPC configuration.  
**Sources**  
[Internet Connectivity Issue: EC2 Instance Cannot Access the Internet | AWS re:Post](https://repost.aws/questions/QUI-ln96DORReym0NJT3z5Ww/internet-connectivity-issue-ec2-instance-cannot-access-the-internet)  
[EC2 instance from Snapshot not accessible | AWS re:Post](https://repost.aws/questions/QUaLMl1CYZS0WPx1izW-c_1A/ec2-instance-from-snapshot-not-accessible)  
[EC2 internet inbound/outbound not working us-east-1, works in all other regions | AWS re:Post](https://repost.aws/questions/QUFVoFWYzQT-2FnhlFYGHYng/ec2-internet-inbound-outbound-not-working-us-east-1-works-in-all-other-regions)

EC2 Instance created from AMI in another Account is missing Internet connectivity

Add your answer

Relevant content