EC2 Image Builder not working in the private subnet
I have retrying to use EC2 Image Builder in a private subnet and image is failing to create with this error. I already created a VPC endpoint for image builder for my private subnet. What else can we done?
Resource handler returned message: "Error occurred during operation 'SSM execution "id" failed for image "xxxx arn" with status = 'Failed' in state = 'BUILDING' and failure message = 'failed to download the EC2 Image Builder Component "xxx arn". Error - operation error imagebuilder: GetComponent, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failed
Hi, I happened to see someone in our organisation contact AWS support about this very thing a few days ago. In summary, the outcome is that outbound internet access is required so your subnet needs NAT Gateway access for example. Here's part of the response from Support:
I reviewed ... and was able to obtain the entire error which is broken down below: "reason": "SSM execution 'xxx' failed for image arn: 'arn:aws:imagebuilder:xxx' with status = 'Failed' in state = 'BUILDING' and failure message = 'failed to download the EC2 Image Builder Component 'arn:aws:imagebuilder:xxx:component/aws-cli-version-2-linux/1.0.3/1'. Error - operation error imagebuilder: GetComponent, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failed, Get "https://imagebuilder.ap-southeast-2.amazonaws.com/GetComponent?componentBuildVersionArn=arn%3Aaws%3Aimagebuilder%3Axxx%3Acomponent%2Faws-cli-version-2-linux%2F1.0.3%2F1\": dial tcp 22.214.171.124:443: i/o timeout'" ...
From the output we can see that it failed to connect to the IP 126.96.36.199 TCP port 443 (https). We can rule out a DNS issue based on the above output but not necessarily a connectivity issue.
From the infrastructure configuration, I can see that the ... instance ... will fail when trying to connect to resources on the public internet.
Does Image Builder supports creating an image from a Marketplace AMI?asked 5 months ago
Is there a way to force load earlier versions of Office Apps in AppStream Image BuilderAccepted Answerasked 2 months ago
EC2 Image Builder updating Launch Templates and wiping Snapshot configurationasked 7 months ago
Does Image Builder support build and test an image in a private VPC subnet without internet access?Accepted Answerasked 4 months ago
How can Ec2 Instance in private subnet access internet via vpc endpoint?Accepted Answerasked 9 days ago
EC2 Image Builder not working in the private subnetasked a month ago
Unable to use Session Manager on EC2 instances in a private subnet with SSM VPC endpointAccepted Answerasked 3 years ago
Placing a Bastion in a Private Isolated Subnetasked 5 months ago
Can I use Private AMI to create a base image for Appstream application ?asked 3 years ago
Unable to connect to EC2 instance in private Subnetasked a year ago