AWS Snapshot did not retain SUSE Linux Enterprise Server billing code

June 2019, the AWS snapshot process was updated to retain the billing code.

This article does not apply to SUSE Linux Enterprise Server for SAP Applications (SLES for SAP) AMIs (Amazon Machine Images) or BYOS (Bring your own subscription) images for SUSE Linux Enterprise Server

Amazon provides customers the ability to create a golden image from a running instance or from a snapshot of a root volume. The golden image can be used to launch new instances that meet customers’ corporate and security policies.

If a golden image was created before June 2019, using a snapshot of a volume from a SUSE Linux Enterprise Server (SLES) AMI on Amazon, the snapshot did not retain the billing code for SLES.

New golden images that were created after June 2019 retain the billing code. The billing code is used to enable access to patches, updates and security fixes when using on-demand instances. If a customer’s EC2 instance(s) is missing the billing code and has access to the Public Cloud Update Infrastructure, the customer is out of compliance.

Below are the steps to determine if an instance is out of compliance:

1.      Check to see if the billing code is present by running the command below on their EC2 instances:

curl http://169.254.169.254/latest/dynamic/instance-identity/document

The command will return the meta-data associated with the EC2 instance. If the value for the key “billingProducts” is null, then move to step 2.

"billingProducts" : null,

If the “billingProducts” value is “bp-6ca54005”, then your instance has the necessary entitlements and this article does not apply to the EC2 instance.

"billingProducts" : [ "bp-6ca54005" ],

2.      Determine if the EC2 instance is connected to the Public Cloud Update Infrastructure by running “zypper ls”. “SMT-http_smt-ec2_susecloud_net” will be listed and enabled as the Repository Index Service.

# | Alias                          | Name                           | Enabled | GPG Check |Refresh | Type
--+--------------------------------+--------------------------------+---------+-----------+--------+--------
1 | SMT-http_smt-ec2_susecloud_net | SMT-http_smt-ec2_susecloud_net | Yes     | ----      | Yes    | ris
2 | cloud_update                   | cloud_update                   | Yes     | ----      | Yes    | plugin

3.      If the “billingProducts” is null and “SMT-http_smt-ec2_susecloud_net” is listed and enabled as the Repository Index Service, then your system is out of compliance.

There are two known options to bring the instance into compliance:

1.      Customers need to purchase SUSE subscriptions and register the purchased subscription on the EC2 instance using SUSEConnect. The customer will need to setup an update infrastructure or connect all EC2 instances to SUSE Customer Center.

2.      Customer can move the EBS volumes from a SLES EC2 instance without a billing code to a SLES EC2 Instance with a billing code. Below is an outline of the process and links to AWS documentation. The process below describes how to re-create the instance. The IP address of the server will change, network security policies that use the IP address of1 the AWS EC2 instance will need to be evaluated or changed.

a.      Launch a new SLES EC2 on-demand instance (EC2 instance A). Please be sure to choose an instance type that matches the instance type of the EC2 instance with the missing AWS billing code (EC2 instance X). The EC2 instance A will replace the EC2 instance X.

b.      Next detach the EBS volume(s) from EC2 instance A and EC2 instance X.

AWS Documentation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html

c.       Attach the EBS volumes that were attached to EC2 instance X to EC2 instance A
                                                               i.
AWS Documentation :
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.html

d.      Start and login to EC2 instance A and validate that the billing code is now associated to the instance.


 

Formerly known as TID7023900