Deploy an EMP package

This topic contains information and steps to set up for and deploy an EMP package.

Requirements for deploying an EMP package

When you deploy an EMP package on Windows Server 2012 or later, AWS credentials and connectivity to the AWS application modernization metrics service are required. The deployment fails if the package cannot validate the supplied AWS credentials or cannot send the mandatory telemetry to AWS.

There are two ways you can provide AWS credentials to the deployment package if they are not set up on the server.

• If your deployment server is not an Amazon EC2 instance, you can configure the AWS profile on the server and update the profile name in the metadata.json file in the root of the packaged folder.

• If your deployment server is an Amazon EC2 instance, you can assign an execute-api:Invoke IAM role to the server.

Configure the AWS profile on the server (server is not an EC2 instance)

You can configure the AWS profile on the server using the AWS CLI or AWS Tools for Windows PowerShell. You must set up a user in your AWS environment. The user must be configured to allow execute-api:Invoke. To configure this, use the following IAM policy to grant permissions to the user of the AWS profile on the server.

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": "execute-api:Invoke", "Resource": "*" }]} 

To provide access, add permissions to your users, groups, or roles:

• Users and groups in AWS IAM Identity Center:

  Create a permission set. Follow the instructions in Create a permission set in the AWS IAM Identity Center User Guide.

• Users managed in IAM through an identity provider:

  Create a role for identity federation. Follow the instructions in Creating a role for a third-party identity provider (federation) in the IAM User Guide.

• IAM users:

  • Create a role that your user can assume. Follow the instructions in Creating a role for an IAM user in the IAM User Guide.

  • (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in Adding permissions to a user (console) in the IAM User Guide.

AWS CLI

When you use the AWS CLI, profile information is stored in the C:\Users\<username>\.aws directory. Use the aws configure command to configure the profile for the user you set up to allow for execute-api:Invoke permissions. The AWS CLI can be downloaded from the Installing, updating, and uninstalling the AWS CLI page. For more information about how to specify a profile using the AWS CLI, see Named profiles.

AWS CLI example

C:\>aws configure
AWS Access Key ID [None]: <EXAMPLE-ACCESSKEY>
AWS Secret Access Key [None]: <EXAMPLE-SECRETKEY>
Default region name [None]: 
Default output format [None]:

C:\>

AWS Tools for Windows PowerShell

When you use AWS Tools for Windows PowerShell, profile information is stored in C:\Users\<username>\AppData\Local\AWSToolkit\RegisteredAccounts.json. Use theSet-AWSCredential command to configure the profile. For more information about how to specify credentials using AWS Tools for PowerShell, see Using AWS credentials in the AWS Tools for PowerShell User Guide.

AWS Tools for Windows PowerShell example

PS C:\Program Files (x86)\AWS Tools\PowerShell\AWSPowerShell> Set-AWSCredential -AccessKey <EXAMPLE-ACCESSKEY> -SecretKey <EXAMPLE-SECRETKEY> -StoreAs default 
PS C:\Program Files (x86)\AWS Tools\PowerShell\AWSPowerShell> 

Note

If you do not specify a name when you create a profile, it will default to default by both the AWS CLI and AWS Tools for PowerShell. You are not required to update the metadata.json file found in the root of the EMP package. If you specify a new name for the profile at a later time, update the AWSProfileName property in the metadata.json file.

Assign IAM role to the server (server is an EC2 instance)

Assign an IAM role to the deployment server and verify that the following IAM policy is applied to it. For more information about how to assign an IAM role, see Creating IAM roles.

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": "execute-api:Invoke", "Resource": "*" }]} 

Connectivity to the AWS application modernization metrics service

The EMP deployment server must have internet connectivity to create a secure http outbound connection to the AWS application modernization service.

Run the deployment tool

To run the deployment tool, perform the following steps.

1. Open a command prompt as an administrator.

2. Run the following command to deploy the package to all of the users of the server, where <path-to-package> is the path of the EMP package, and <switches> are the relevant command line switches you want to specify.

   <path-to-package>\Compatibility.Package.Deployment.Exe /<switches>

   For example:

   C:\EMP\Package0001\Compatibility.Package.Deployment.Exe /acceptEULA /deploydir "C:\Programdata\EMP" /DeployAllRegistry 

   When you run this command, the following operations are performed.

   • All files in the <path_to_package> folder are copied to the specified /deploydir.

   • All shortcuts specified in the shortcuts.xml are written to the public profile for visibility to all users of the server.

   • Shortcuts for a path in the user desktop or Start menu are translated to the equivalent of the directory of the public profile.

   • Any file type associations specified in the FileAssociation.xml are created in HKLM root key of the registry.

   • If the /deploydir switch is provided, the package is copied to the specified folder.

   • The /DeployAllRegistry switch makes the EMP package accessible for all users at the machine level.