View a markdown version of this page

Launch the endpoint instance - AWS Elastic Disaster Recovery

Launch the endpoint instance

Launch a dedicated Amazon EC2 instance to act as the test endpoint, and allow TCP port 1500 to it from your source servers. For instructions on launching and connecting to an instance, see Get started with Amazon EC2 in the Amazon EC2 User Guide. When you launch it, make the following choices:

  • Choose the standard Amazon Linux 2023 AMI, not the minimal AMI. You can resolve it from its public SSM parameter: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 for an x86_64 instance, or /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-arm64 for a Graviton (arm64) instance. For the AMI and its SSM parameter names, see AL2023 on Amazon EC2 in the Amazon Linux 2023 User Guide.

  • Launch it in the staging area subnet from your replication settings, and match those settings as closely as you can, including the Use private IP for data replication choice. See Choosing your connectivity path.

  • To test from inside the VPC without an existing source server, launch a second instance in the same VPC. Use its private IP as the source address in the port 1500 rule.

  • Choose an instance type large enough that the endpoint is not the bottleneck. For more information, see Amazon EC2 instance network bandwidth in the Amazon EC2 User Guide. If you choose a Graviton type, use the arm64 AMI and set ARCH_TARGET as described in Download and unpack the endpoint software.

  • Make sure that you can open a shell on the instance, by whichever method you normally use. The method you choose has consequences for the rest of this procedure, because each method has its own setup that you provide at launch time and remove at teardown. SSH, for example, needs a key pair that you select at launch and an inbound rule of its own (such as TCP port 22); Session Manager instead needs an instance profile on the instance and outbound HTTPS to the Session Manager endpoints, and no inbound rule. Provide whatever your chosen method requires. For the options, see Connect to your EC2 instance in the Amazon EC2 User Guide, which documents each one. If your egress address rotates across a NAT pool, any inbound access rule needs every address in the pool, the same as the port 1500 rule.

  • Give the instance outbound HTTPS access to download the endpoint software in Download and unpack the endpoint software, or plan to copy the archive to it.

After launch, add an inbound rule for TCP port 1500 from the address of each source server. Put this rule in a security group you create for this test, rather than editing a shared or default security group: the endpoint is unauthenticated, so every instance that shares the group would inherit the open port. Attach that dedicated group to the endpoint alongside whatever security group your shell-access method already requires (for example, one that allows TCP port 22 for SSH). You do not need to move or remove the access rule; only keep the port 1500 rule out of a shared group. For instructions, see Configure security group rules in the Amazon EC2 User Guide. Every address that this rule allows can run tests against the endpoint, which has no authentication. Allow only the addresses you test from. See Security considerations for the test endpoint.

A stop and start changes the public address, so if you stop the instance after you generate the certificate, generate it again in Generate the TLS certificate.