Do I need to reboot an EC2 instance that has been updated via 'yum update' first before making an AMI image of it?

Question

I have SSHed into an EC2 instance and the logs tell me that two security related packages are available for installing. I can install them by running `sudo yum update`. Some Linux packages may require an EC2 reboot in order to take effect.

After installing the packages I like to create a new AMI image of the EC2 instance that reflects these updates. But I need to be sure that any (kernel) updates (the ones that require a reboot) are also used whenever the image is used to create a new EC2 server. In other words the resulting new EC2 server should not have to reboot to implement the installed kernel updates present in the image.

So my question is this: If I've installed packages with `yum update` and I want to create an image of the update EC2 server, do I first need to reboot this EC2 server before creating an new AMI image in order to implement any kernel changes? Or will these kernel changes also happen when I don't reboot and instead immediately create an AMI image but with the 'reboot' option set to 'true'?

Answer

See section "create image" of https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.html to answer your question

Answer

An in-depth Linux-specific question like this is best asked on a Linux forum, or if you are running RHEL (you mention using `yum`) then log a support call with Red Hat.

You're not going to get a watertight answer from AWS on this (even if you're running Amazon Linux, which is really just a fork of Fedora), nor should you rely on the well-meaning but unpaid contributors to this forum to give you an answer you can take to the bank.

FWIW I think what you describe should be okay, as part of the `yum update` it should do any `mkinitrd` or `dracut` operations that it needs to, fix up any changes that need to be made in GRUB, and so on. So if you made your new AMI at this point and then spun up a new EC2 from that AMI, it should be ready to roll.

But making sense in your head isn't the same as actually working in the real world. It's best to try this in various scenarios and report back what works and what doesn't, and perhaps even write a Knowledge Centre article about it?

Do I need to reboot an EC2 instance that has been updated via 'yum update' first before making an AMI image of it?

Relevant content