Need help please: Getting an error creating Elastic instance app blocks

Question

I'm trying to create the app block builders and app blocks for the Elastic Instances I plan on using.  I've never created Elastic Instances or app block builders or app blocks before, so I'm sure I'm doing something wrong.  When I get to the point in the application builder that I run "Finish app block creation and disconnect to create the application package and upload it," I get this error:  "Failed to upload VHD.  Please check your bucket policy and retry."  I've checked my bucket policy and retried multiple times, and it keeps failing.  Here are the specifics:

1.  I created the app block builder.  I gave it a name, OS (Windows Server), selected stream.standard.small, enabled default internet access, and defaulted subnet and and 2 to the first subnet entry.  The app block builder was built.

2.  Under App Blocks, I clicked the WHITE "Create app block button."  I left "AppStream 2.0 app block" selected.  I entered the name and display name.  Didn't do anything under Advanced options.  Under Import Settings, I left "Create ..." selected.  The build worked.

3.  I created a new S3 bucket.  I named it, left "ACLs disabled," selected "Block all public access," left Bucket Versioning disabled, left encryption set to SSE-S3, left Bucket key set to Enable (although it's only for SEE-KMS).  I entered the bucket policy as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAppStream2.0ToPutAndRetrieveObjects",
            "Effect": "Allow",
            "Principal": {
                "Service": "appstream.amazonaws.com"
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetBucketOwnershipControls"
            ],
            "Resource": [
                "arn:aws:s3:::*mybucketname*",
                "arn:aws:s3:::*mybucketname*/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "*my-account-id-number*"
                }
            }
        }
    ]
}

There were no errors in the policy, and I was able to save the policy and the bucket.

4.  In App block builders, I selected the builder I previously created and launched it.

5.  I downloaded the files I needed for my app to the temporary directory.  There is no "installation" program.  Just an executable (.EXE) and a few ancillary files.  I started the Application Builder Assistant, and started recording, and copied those files to C:\Users\AppBlockBuilderAdmin\AppData\Local\Programs\MyAppDir.  (I don't know if that's the right place to put them for AppStream, but that's how it's installed when I install my app on regular Windows PCs.)  I stopped recording, and clicked "Finish app block creation and disconnect to create the application package and upload it," and that's when I got the error "Failed to upload VHD.  Please check your bucket policy and retry."  As I said, I did check the policy and retry.

Note that I'm not using IAM policies (I'm not using IAM at all).  I don't use Active Directory.  My users will just be logging in either their email addresses and passwords.  I add users in the User Pool.

In case you're wondering why I'm not doing this with On Demand instances, while I've been able to install and get my app to work remotely by using On Demand instances, I found it was too expensive for my use case (very sporadic use and very short session durations).  The pricing estimator shows that I will save significantly on costs by using Elastic instances.

At this point I'm lost and don't know how to proceed.  I hope someone here who has successfully created Elastic Instances can help me.  Thanks so much!

rePost-User-5576858 · Answer

OP here. The "AWS Generative AI" reply actually solved the problem. Once I removed the Condition Block from the bucket policy, the block creation finished successfully. Now, the only reason I added the Condition Block in the first place was because when I first DIDN'T have that block, AppStream complained that I was providing more access than was necessary. Is there a middle ground where I can properly restrict access but not have the block creation fail?

rePost-User-5576858

answered 2 years ago

re:Post Agent · Answer

I understand you're having trouble creating app blocks for Elastic instances in AppStream 2.0. Let's go through the process and identify potential issues:

1. Your app block builder creation seems correct. Enabling default internet access and selecting the appropriate instance type are good steps.

2. The app block creation process you described is also correct.

3. For the S3 bucket, there are a few things to consider:
- The bucket policy looks generally correct, but make sure you've replaced *mybucketname* and *my-account-id-number* with your actual bucket name and AWS account ID.
- Ensure the bucket is in the same region as your AppStream 2.0 resources.

4. Launching the app block builder is correct.

5. For the application installation:
- The location C:\Users\AppBlockBuilderAdmin\AppData\Local\Programs\MyAppDir is acceptable, but you might also consider using C:\Program Files or C:\Program Files (x86) for consistency with typical Windows installations.
- Make sure you've captured all necessary files and any required registry changes during the recording process.

The error "Failed to upload VHD" suggests there might be an issue with permissions or connectivity to the S3 bucket. Here are some things to check:

1. Verify that the app block builder instance has internet connectivity to reach S3.
2. Double-check that the bucket name in your policy exactly matches the actual bucket name.
3. Ensure your AWS account ID is correct in the bucket policy.
4. Try removing the Condition block from your bucket policy temporarily to see if it resolves the issue.
5. Check if there are any VPC endpoints that might be interfering with the S3 connection.
6. Verify that the IAM role associated with the app block builder (if any) has the necessary permissions to access S3.

If these steps don't resolve the issue, you may need to check the AppStream 2.0 service logs or contact AWS support for further assistance. They can provide more detailed diagnostics on why the VHD upload is failing.

Regarding your decision to use Elastic fleets over On-Demand, that's a good choice for sporadic use and short sessions, as it can indeed be more cost-effective in such scenarios.  
**Sources**  
[Enable Internet Access for Your App Block Builder in Amazon AppStream 2.0 - Amazon AppStream 2.0](https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-network-enable-internet-access-app-block-builder.html)  
[Create an App Block Builder - Amazon AppStream 2.0](https://docs.aws.amazon.com/appstream2/latest/developerguide/create-app-block-builder.html)  
[create-app-block-builder — AWS CLI 2.17.64 Command Reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/appstream/create-app-block-builder.html)  
[Create an App Block with an Existing App Package - Amazon AppStream 2.0](https://docs.aws.amazon.com/appstream2/latest/developerguide/appstream-app-blocks-create-VHD.html)

Need help please: Getting an error creating Elastic instance app blocks

Add your answer

Relevant content