-
Notifications
You must be signed in to change notification settings - Fork 0
/
AWS Server Migration Service
1991 lines (1979 loc) · 95.9 KB
/
AWS Server Migration Service
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
https://aws.amazon.com/blogs/apn/aws-server-migration-service-server-migration-to-the-cloud-made-easy/
https://docs.aws.amazon.com/server-migration-service/latest/userguide/server-migration-ug.pdf
AWS Server Migration Service
What Is AWS SMS?
AWS Server Migration Service automates the migration of your on-premises VMware vSphere or
Microsoft Hyper-V/SCVMM virtual machines to the AWS Cloud. AWS SMS incrementally replicates your
server VMs as cloud-hosted Amazon Machine Images (AMIs) ready for deployment on Amazon EC2.
Working with AMIs, you can easily test and update your cloud-based images before deploying them in
production.
By using AWS SMS to manage your server migrations, you can:
• Simplify the cloud migration process. You can begin migrating a group of servers with just a few
clicks in the AWS Management Console. After the migration has initiated, AWS SMS manages all the
complexities of the migration process, including automatically replicating volumes of live servers
to AWS and creating new AMIs periodically. You can quickly launch EC2 instances from AMIs in the
console.
• Orchestrate multi-server migrations. AWS SMS orchestrates server migrations by allowing you to
schedule replications and track progress of a group of servers that constitutes an application. You can
schedule initial replications, configure replication intervals, and track progress for each server using
the console. When you launch a migrated application, you can apply customized configuration scripts
that run during startup.
• Test server migrations incrementally: With support for incremental replication, AWS SMS allows fast,
scalable testing of migrated servers. Because AWS SMS replicates incremental changes to your onpremises servers and transfers only the delta to the cloud, you can test small changes iteratively and
save on network bandwidth.
• Support the most widely used operating systems. AWS SMS supports the replication of operating
system images containing Windows, as well as several major Linux distributions.
• Minimize downtime. Incremental AWS SMS replication minimizes the business impact associated with
application downtime during the final cutover.
Use of AWS SMS is limited as follows:
• 50 concurrent VM migrations per account, unless a customer requests a limit increase.
• 90 days of service usage per VM (not per account), beginning with the initial replication of a VM. We
terminate an ongoing replication after 90 days unless a customer requests a limit increase.
• 50 concurrent application migrations per account, with a limit of 10 groups and 50 servers in each
application.
Pricing
There is no additional fee to use Server Migration Service. You pay the standard fees for the S3 buckets,
EBS volumes, and data transfer used during the migration process, and for the EC2 instances that you
run.
General Requirements
Server Migration Service (SMS)
Requirements
Your VMware vSphere or Microsoft Hyper-V/SCVMM environment must meet the following requirements
for you to use the Server Migration Service to migrate your on-premises virtualized servers to Amazon
EC2.
General Requirements
Before setting up AWS SMS, take action as needed to meet all of the following requirements.
All VMs
• Disable any antivirus or intrusion detection software on the VM you are migrating. These services can
be re-enabled after the migration process is complete.
• Disconnect any CD-ROM drives (virtual or physical) connected to the VM.
Windows VMs
• Enable Remote Desktop (RDP) for remote access.
• Install the appropriate version of .NET Framework on the VM. Note that .NET Framework 4.5 or later
will be installed automatically on your VM if required.
Windows Version .NET Framework Version
Windows Server 2008 or earlier 3.5 or later
Windows Server 2008 R2 or later 4.5 or later
Windows 8 or earlier 3.5 or later
Windows 8.1 or later 4.5 or later
• When preparing a Microsoft Windows VM for migration, configure a fixed pagefile size and ensure that
at least 6 GiB of free space is available on the root volume. This is necessary for successful installation
of the drivers.
• Make sure that your host firewall (such as Windows firewall) allows access to RDP. Otherwise, you will
not be able to access your instance after the migration is complete.
• Apply the following hotfixes:
• You cannot change system time if RealTimeIsUniversal registry entry is enabled in Windows
• High CPU usage during DST changeover in Windows Server 2008, Windows 7, or Windows Server
2008 R2
Linux VMs
• Enable Secure Shell (SSH) for remote access.
• Make sure that your host firewall (such as iptables) allows access to SSH. Otherwise, you will not be
able to access your instance after the migration is complete.
• Make sure that your Linux VM uses GRUB (GRUB legacy) or GRUB 2 as its bootloader.
AWS Server Migration Connector Requirements
• Make sure that the root volume of your Linux VM uses one of the following file systems:
• EXT2
• EXT3
• EXT4
• Btrfs
• JFS
• XFS
Programmatic Modifications to VMs
When importing a VM, AWS modifies the file system to make the imported VM accessible to the
customer. The following actions may occur:
• [Linux] Installing Citrix PV drivers either directly in OS or modify initrd/initramfs to contain them.
• [Linux] Modifying network scripts to replace static IPs with dynamic IPs.
• [Linux] Modifying /etc/fstab, commenting out invalid entries and replacing device names with
UUIDs. If no matching UUID can be found for a device, the nofail option is added to the device
description. You will need to correct the device naming and remove nofail after import. As a best
practice when preparing your VMs for import, we recommend that you specify your VM disk devices by
UUID rather than device name.
Entries in /etc/fstab that contain distributed file system types (nfs, cifs, smbfs, vboxsf, sshfs, etc.)
will be disabled.
• [Linux] Modifying grub bootloader settings such as the default entry and timeout.
• [Windows] Modifying registry settings to make the VM bootable.
When writing a modified file, AWS retains the original file at the same location under a new name.
AWS Server Migration Connector Requirements
The Server Migration Connector is a FreeBSD VM that you install in your on-premises virtualization
environment. Its hardware and software requirements are as follows:
Requirements for VMware connector
• vCenter version 5.1 or higher (validated up to 6.7)
• ESXi 5.1 or higher (validated up to 6.7)
• Minimum 8 GiB RAM
• Minimum available disk storage of 20 GiB (thin-provisioned) or 250 GiB (thick-provisioned)
• Support for the following network services. Note that you might need to reconfigure your firewall to
permit stateful outbound connections from the connector to these services.
• DNS—Allow the connector to initiate connections to port 53 for name resolution.
• HTTPS on vCenter—Allow the connector to initiate secure web connections to port 443 of vCenter.
You can also configure a non-default port at your discretion.
Note
If your vCenter Server is configured to use a non-default port, enter both the vCenter's
hostname and port, separated by a colon (for example, HOSTNAME:PORT or IP:PORT) in
the vCenter Service Account page in Connector setup.
• HTTPS on ESXi—Allow the connector to initiate secure web connections to port 443 of the ESXi
hosts containing the VMs you intend to migrate.
3
AWS Server Migration Service User Guide
Operating Systems Supported by AWS SMS
• NTP—Optionally, give the connector access to ntp.org on port 123. If the connector synchronises its
clock with the ESXi host, this is unnecessary.
• Allow outbound connections from the connector to the following URL ranges:
• *.amazonaws.com
• *.aws.amazon.com
• *.ntp.org (Optional; used only to validate that connector time is in sync with NTP.)
Requirements for Hyper-V connector
• Hyper-V role on Windows Server 2012 R2 or Windows Server 2016
• Active Directory 2012 or above
• [Optional] SCVMM 2012 SP1 or SCVMM 2016
• Minimum 8 GiB RAM
• Minimum available disk storage of 300 GiB
• Support for the following network services. Note that you might need to reconfigure your firewall to
permit stateful outbound connections from the connector to these services.
• DNS—Allow the connector to initiate connections to port 53 for name resolution.
• HTTPS on WinRM port 5986 on your SCVMM or standalone Hyper-V host
• Inbound HTTPS on port 443 of the connector—Allow the connector to receive secure web
connections on port 443 from Hyper-V hosts containing the VMs you intend to migrate.
• NTP—Optionally, give the connector access to ntp.org on port 123. If the connector synchronises its
clock with the ESXi host, this is unnecessary.
• Allow outbound connections from the connector to the following URL ranges:
• *.amazonaws.com
• *.aws.amazon.com
• *.ntp.org (Optional; used only to validate that connector time is in sync with NTP.)
Operating Systems Supported by AWS SMS
The following operating systems can be migrated to EC2 using SMS:
Windows (32- and 64-bit)
• Microsoft Windows Server 2003 (Standard, Datacenter, Enterprise) with Service Pack 1 (SP1) or later
(32- and 64-bit)
• Microsoft Windows Server 2003 R2 (Standard, Datacenter, Enterprise) (32- and 64-bit)
• Microsoft Windows Server 2008 (Standard, Datacenter, Enterprise) (32- and 64-bit)
• Microsoft Windows Server 2008 R2 (Standard, Datacenter, Enterprise) (64-bit only)
• Microsoft Windows Server 2012 (Standard, Datacenter) (64-bit only)
• Microsoft Windows Server 2012 R2 (Standard, Datacenter) (64-bit only) (Nano Server installation not
supported)
• Microsoft Windows Server 2016 (Standard, Datacenter) (64-bit only)
• Microsoft Windows Server, versions 1709, 1803 (Standard, Datacenter) (64-bit only)
• Microsoft Windows 7 (Professional, Enterprise, Ultimate) (US English) (32- and 64-bit)
• Microsoft Windows 8 (Professional, Enterprise) (US English) (32- and 64-bit)
• Microsoft Windows 8.1 (Professional, Enterprise) (US English) (64-bit only)
• Microsoft Windows 10 (Professional, Enterprise, Education) (US English) (64-bit only)
4
AWS Server Migration Service User Guide
Volume Types and File Systems Supported by AWS SMS
Linux/Unix (64-bit)
• Ubuntu 12.04, 12.10, 13.04, 13.10, 14.04, 14.10, 15.04, 16.04, 16.10
• Red Hat Enterprise Linux (RHEL) 5.1-5.11, 6.1-6.9, 7.0-7.3 (6.0 lacks required drivers)
Note
See Limitations (p. 7) for additional information about RHEL 5.x support.
• SUSE Linux Enterprise Server 11 with Service Pack 1 and kernel 2.6.32.12-0.7
• SUSE Linux Enterprise Server 11 with Service Pack 2 and kernel 3.0.13-0.27
• SUSE Linux Enterprise Server 11 with Service Pack 3 and kernel 3.0.76-0.11, 3.0.101-0.8, or
3.0.101-0.15
• SUSE Linux Enterprise Server 11 with Service Pack 4 and kernel 3.0.101-63
• SUSE Linux Enterprise Server 12 with kernel 3.12.28-4
• SUSE Linux Enterprise Server 12 with Service Pack 1 and kernel 3.12.49-11
• SUSE Linux Enterprise Server 12 with Service Pack 2 and kernel 4.4
• SUSE Linux Enterprise Server 12 with Service Pack 3 and kernel 4.4
• CentOS 5.1-5.11, 6.1-6.6, 7.0-7.3 (6.0 lacks required drivers)
• Debian 6.0.0-6.0.8, 7.0.0-7.8.0, 8.0.0
• Oracle Linux 6.1-6.6, 7.0-7.1
• Fedora Server 19-21
Volume Types and File Systems Supported by AWS
SMS
AWS Server Migration Service supports migrating Windows and Linux instances with the following file
systems:
Operating
System
File System Architecture Partition
Table
Data Volumes
Supported
Boot Volumes
Supported
32-bit MBR ✔ ✔
GPT ✔
MBR ✔ ✔
Windows NTFS
64-bit
GPT ✔ ✔
Linux/Unix ext2, ext3, MBR ✔ ✔
ext4, Btrfs, JFS,
XFS
64-bit
GPT ✔
AMIs with volumes using EBS encryption are not supported.
Licensing Options
When you create a new replication job, the AWS Server Migration Service console provides a License
type option. The possible values include:
5
AWS Server Migration Service User Guide
Licensing for Linux
• Auto (default)
Detects the source-system operating system (OS) and applies the appropriate license to the migrated
virtual machine (VM).
• AWS
Replaces the source-system license with an AWS license, if appropriate, on the migrated VM.
• BYOL
Retains the source-system license, if appropriate, on the migrated VM.
Note
If you choose a license type that is incompatible with your VM, the replication job fails with an
error message. For more information, see the OS-specific information below.
The same licensing options are available through the AWS SMS API and CLI. For example:
aws sms create-replication-job --license-type <value>
The value of the --license-type parameter can be AWS or BYOL. Leaving it unset is the same as
choosing Auto in the console.
Licensing for Linux
Linux operating systems support only BYOL licenses. Choosing Auto (the default) means that AWS SMS
uses a BYOL license.
Migrated Red Hat Enterprise Linux (RHEL) VMs must use Cloud Access (BYOL) licenses. For more
information, see Red Hat Cloud Access on the Red Hat website.
Migrated SUSE Linux Enterprise Server VMs must use SUSE Public Cloud Program (BYOS) licenses. For
more information, see SUSE Public Cloud Program—Bring Your Own Subscription.
Licensing for Windows
Windows server operating systems support either BYOL or AWS licenses. Windows client operating
systems (such as Windows 10) support only BYOL licenses.
If you choose Auto (the default), AWS SMS uses the AWS license if the VM has a server OS. Otherwise,
the BYOL license is used.
The following rules apply when you use your BYOL Microsoft license, either through MSDN or Windows
Software Assurance Per User:
• Your BYOL instances are priced at the prevailing Amazon EC2 Linux instance pricing, provided that you
meet the following conditions:
• Run on a Dedicated Host (Dedicated Hosts)
• Launch from VMs sourced from software binaries provided by you using AWS SMS, which are subject
to the current terms and abilities of AWS SMS
• Designate the instances as BYOL instances
• Run the instances within your designated AWS regions, and where AWS offers the BYOL model
• Activate using Microsoft keys that you provide or which are used in your key management system
• You must account for the fact that when you start an Amazon EC2 instance, it can run on any one of
many servers within an Availability Zone. This means that each time you start an Amazon EC2 instance
(including a stop/start), it may run on a different server within an Availability Zone. You must account
6
AWS Server Migration Service User Guide
Limitations
for this fact in light of the limitations on license reassignment, as described in the Microsoft Volume
Licensing Product Terms available at Licensing Terms, or consult your specific use rights to determine if
your rights are consistent with this usage.
• You must be eligible to use the BYOL program for the applicable Microsoft software under your
agreements with Microsoft, for example, under your MSDN user rights or under your Windows
Software Assurance Per User Rights. You are solely responsible for obtaining all required licenses and
for complying with all applicable Microsoft licensing requirements, including the PUR/PT. Further,
you must have accepted Microsoft's End User License Agreement (Microsoft EULA), and by using the
Microsoft Software under the BYOL program, you agree to the Microsoft EULA.
• AWS recommends that you consult with your own legal and other advisers to understand and comply
with the applicable Microsoft licensing requirements. Usage of the Services (including usage of
the licenseType parameter and BYOL flag) in violation of your agreements with Microsoft is not
authorized or permitted.
Limitations
Image Format
• When migrating VMs managed by Hyper-V/SCVMM, SMS supports both Generation 1 VMs (using
either VHD or VHDX disk format) and Generation 2 VMs (VHDX only).
• AWS SMS does not support VMs on Hyper-V running any version of RHEL 5 if backed by a VHDX disk.
We recommend converting disks in this format to VHD for migration.
• AWS SMS does not support VMs that have a mix of VHD and VHDX disk files.
• On VMware, AWS SMS does not support VMs that use Raw Device Mapping (RDM). Only VMDK disk
images are supported.
File System
• Migrated Linux VMs must use 64-bit images. Migrating 32-bit Linux images is not supported.
• Migrated Linux VMs should use default kernels for best results. VMs that use custom Linux kernels
might not migrate successfully.
• When preparing Amazon EC2 Linux VMs for migration, make sure that at least 250 MiB of disk space
is available on the root volume for installing drivers and other software. For Microsoft Windows VMs,
configure a fixed pagefile size and ensure that at least 6 GiB of free space is available on the root
volume.
Booting
• UEFI/EFI boot partitions are supported only for Windows boot volumes with VHDX as the image
format. Otherwise, a VM's boot volume must use Master Boot Record (MBR) partitions. In either case,
boot volume cannot exceed 2 TiB (uncompressed) due to MBR limitations.
Note
When AWS detects a Windows GPT boot volume with an UEFI boot partition, it converts it
on-the-fly to an MBR boot volume with a BIOS boot partition. This is because EC2 does not
directly support GPT boot volumes.
• An imported VM may fail to boot if the root partition is not on the same virtual hard drive as the MBR.
• A migrated VM may fail to boot if the root partition is not on the same virtual hard disk as the MBR.
• Migrating VMs with dual-boot configurations is not supported.
7
AWS Server Migration Service User Guide
Networking
Networking
• Multiple network interfaces are not currently supported. After migration, your VM will have a single
virtual network interface that uses DHCP to assign addresses. Your instance receives a private IP
address.
• A VM migrated into a VPC does not receive a public IP address, regardless of the auto-assign public IP
setting for the subnet. Instead, you can allocate an Elastic IP address to your account and associate it
with your instance.
• Internet Protocol version 6 (IPv6) IP addresses are not supported.
Application Import from Migration Hub
• SMS imports application-related servers from AWS Migration Hub only if they exist in the SMS Server
Catalog. As a result, some applications may only be partially migrated.
• If none of the servers in a Migration Hub application exist in the SMS Server Catalog, the import will
fail silently and the application will not be visible in SMS.
• Imported applications can be migrated but cannot be edited in SMS. They can, however, be edited in
Migration Hub.
Miscellaneous
• An SMS replication job will fail for VMs with more than 22 volumes attached.
• AMIs with volumes using EBS encryption are not supported.
• AWS SMS creates AMIs that use Hardware Virtual Machine (HVM) virtualization. It can't create AMIs
that use Paravirtual (PV) virtualization. Linux PVHVM drivers are supported within migrated VMs.
• VMs that are created as the result of a P2V conversion are not supported. A P2V conversion occurs
when a disk image is created by performing a Linux or Windows installation process on a physical
machine and then importing a copy of that Linux or Windows installation to a VM.
• AWS SMS does not install the single root I/O virtualization (SR-IOV) drivers except with imports
of Microsoft Windows Server 2012 R2 VMs. These drivers are not required unless you plan to use
enhanced networking, which provides higher performance (packets per second), lower latency, and
lower jitter. For Microsoft Windows Server 2012 R2 VMs, SR-IOV drivers are automatically installed as a
part of the migration process.
• Because independent disks are unaffected by snapshots, AWS SMS does not support interval
replication for VMDKs in independent mode.
• Windows language packs that use UTF-16 (or non-ASCII) characters are not supported for import. We
recommend using the English language pack when importing Windows Server 2003, Windows Server
2008, and Windows Server 2012 R1 VMs.
Other Requirements
Support for VMware vMotion
AWS Server Migration Service partially supports vMotion, Storage vMotion, and other features based on
virtual machine migration (such as DRS and Storage DRS) subject to the following limitations:
• Migrating a virtual machine to a new ESXi host or datastore after one replication run ends, and before
the next replication run begins, is supported as long as the Server Migration Connector's vCenter
8
AWS Server Migration Service User Guide
Other Requirements
service account has sufficient permissions on the destination ESXi host, datastores, and datacenter, and
on the virtual machine itself at the new location.
• Migrating a virtual machine to a new ESXi host, datastore, and/or datacenter while a replication run is
active—that is, while a virtual machine upload is in progress—is not supported.
• Cross vCenter vMotion is not supported for use with the AWS Server Migration Service.
Support for VMware vSAN
VMs on vSAN datastores are only supported when Replication job type on the Configure replication
jobs settings page is set to One-time migration.
Support for VMware Virtual Volumes (VVol)
AWS does not provide support for migrating VMware Virtual Volumes. Some implementations may work,
however.
VMs with Snapshots
AWS SMS supports only one-time migration on VMs where snapshot-based backup software is used.
Also, avoid creating snapshots on VMs replicated through AWS SMS.
9
AWS Server Migration Service User Guide
Configure AWS SMS Permissions and Roles
Getting Started with AWS Server
Migration Service
This section describes procedures for setting up AWS Server Migration Service for either of the two
supported platforms, VMware vSphere or Microsoft Hyper-V/SCVMM.
Contents
• Configure AWS SMS Permissions and Roles (p. 10)
• Installing the Server Migration Connector on VMware (p. 15)
• Installing the Server Migration Connector on Hyper-V (p. 18)
Configure AWS SMS Permissions and Roles
The following permission and role prerequisites apply to either platform supported by AWS SMS.
Configure User Permissions for AWS SMS
If your IAM user account, group, or role is assigned administrator permissions, then you already have
access to AWS SMS. To call the AWS SMS API with the credentials of an IAM user that does not have
administrative access to your AWS account, create a custom inline policy defined by the following JSON
code and apply it to the IAM user:
{
"Version":"2012-10-17",
"Statement":[
{
"Action":[
"sms:*"
],
"Effect":"Allow",
"Resource":"*"
},
{
"Action":[
"cloudformation:ListStacks",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackResources"
],
"Effect":"Allow",
"Resource":"*"
},
{
"Action":[
"s3:ListAllMyBuckets",
"s3:GetObject"
],
"Effect":"Allow",
"Resource":"*"
},
{
10
AWS Server Migration Service User Guide
Configure an IAM User for Server Migration Connector
"Action":[
"ec2:DescribeKeyPairs",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups"
],
"Effect":"Allow",
"Resource":"*"
},
{
"Action":"iam:PassRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringLike":{
"iam:AssociatedResourceArn":"arn:aws:cloudformation:*:*:stack/sms-app-*/*"
}
}
}
]
}
Note
If you are using multiple connectors, we recommend that you create a unique IAM role for each
connector to avoid having a single point of failure.
Configure an IAM User for Server Migration
Connector
To create an IAM user for Server Migration Connector in your AWS account
1. Create a new IAM user for your connector to communicate with AWS. Save the generated access key
and secret key for use during the initial connector setup. For information about managing IAM users
and permissions, see Creating an IAM User in Your AWS Account.
2. Attach the managed IAM policy ServerMigrationConnector to the IAM user. For more
information, see Managed Policies and Inline Policies.
Configure a Service Role for AWS SMS
Use one of the following procedures to create an IAM role that grants permissions to AWS SMS to place
migrated resources into your Amazon EC2 account. In AWS Regions that make an IAM role template
available, Option 1 works. If you find that no template for AWS Server Migration Service exists in your
AWS Region, proceed to Option 2.
Option 1: Create an AWS SMS IAM role with a template
1. Open the IAM console at https://console.aws.amazon.com/iam/.
2. In the navigation pane, choose Roles, Create role.
3. Under Choose the service that will use this role, choose SMS, Next: Permissions.
4. Under Attached permissions policies, confirm that the policy ServerMigrationServiceRole is visible
and choose Next: Review.
5. Under Review, for Role name, type sms.
Note
Alternatively, you can apply a different name, but you must then specify the role name
explicitly each time that you create a replication job or an application.
11
AWS Server Migration Service User Guide
Configure a Service Role for AWS SMS
6. Choose Create role. You should now see the sms role in the list of available roles.
Use the following option in AWS Regions that do not make an IAM role template available. This option
also works as a manual alternative to Option 1 in all Regions.
Option 2: Create an AWS SMS IAM role manually
1. Create a local file named trust-policy.json with the following content:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "sms.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "sms"
}
}
}
]
}
2. Create a local file named role-policy.json with the following content:
{
"Version":"2012-10-17",
"Statement":[
{
"Action":[
"cloudformation:CreateChangeSet",
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:ExecuteChangeSet"
],
"Resource":"arn:aws:cloudformation:*:*:stack/sms-app-*/*",
"Effect":"Allow",
"Condition":{
"ForAllValues:StringLikeIfExists":{
"cloudformation:ResourceTypes":[
"AWS::EC2::*"
]
}
}
},
{
"Action":[
"cloudformation:DeleteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplate"
],
"Resource":"arn:aws:cloudformation:*:*:stack/sms-app-*/*",
"Effect":"Allow"
},
{
"Action":[
12
AWS Server Migration Service User Guide
Configure a Service Role for AWS SMS
"cloudformation:DescribeStacks",
"cloudformation:ValidateTemplate",
"cloudformation:DescribeStackResource",
"s3:ListAllMyBuckets"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":[
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:DeleteObject",
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutLifecycleConfiguration",
"s3:ListAllMyBuckets"
],
"Resource":"arn:aws:s3:::sms-app-*",
"Effect":"Allow"
},
{
"Action":[
"sms:CreateReplicationJob",
"sms:DeleteReplicationJob",
"sms:GetReplicationJobs",
"sms:GetReplicationRuns",
"sms:GetServers",
"sms:ImportServerCatalog",
"sms:StartOnDemandReplicationRun",
"sms:UpdateReplicationJob"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":[
"ec2:ModifySnapshotAttribute",
"ec2:CopySnapshot",
"ec2:CopyImage",
"ec2:Describe*",
"ec2:DeleteSnapshot",
"ec2:DeregisterImage",
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource":"*",
"Effect":"Allow"
},
{
"Action":"iam:GetRole",
"Resource":"*",
"Effect":"Allow"
},
{
"Action":"iam:PassRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringLike":{
"iam:AssociatedResourceArn":"arn:aws:cloudformation:*:*:stack/sms-app-*/
*"
13
AWS Server Migration Service User Guide
Configure a Launch Role for AWS SMS
}
}
}
]
}
3. At a command prompt, go to the directory where you stored the two JSON policy files, and run the
following commands to create the AWS SMS service role:
aws iam create-role --role-name sms --assume-role-policy-document file://trustpolicy.json
aws iam put-role-policy --role-name sms --policy-name sms --policy-document
file://role-policy.json
Note
Your AWS CLI user must have permissions on IAM. You can grant these by attaching the
IAMFullAccess managed policy to your AWS CLI user. For information about managing IAM
users and permissions, see Creating an IAM User in Your AWS Account.
Configure a Launch Role for AWS SMS
If you plan to launch applications, you need an AWS SMS launch role. You assign this role using the
PutAppLaunchConfiguration API. When the LaunchApp API is called, the role is used by AWS
CloudFormation.
Use one of the following procedures to configure this role. Use Option 2 in AWS Regions that do not
make an AWS SMS launch role template available, or as a manual alternative to Option 1 in all Regions.
Option 1: Create an AWS SMS launch role with a template
1. Open the IAM console at https://console.aws.amazon.com/iam/.
2. In the navigation pane, choose Roles, Create role.
3. Under Choose the service that will use this role, choose CloudFormation, Next: Permissions.
4. Under Attached permissions policies, confirm that the policy ServerMigrationServiceLaunchRole is
visible and choose Next: Review.
5. Under Review, for Role name, type sms-launch.
Note
Alternatively, you can apply a different name, but you must then specify the role name
explicitly each time that you create a launch configuration for an application.
6. Choose Create role. You should now see the sms-launch role in the list of available roles.
Option 2: Create an AWS SMS launch role manually
1. Create a local file named trust-policy.json with the following content:
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Principal":{
"Service":"cloudformation.amazonaws.com"
},
"Action":"sts:AssumeRole"
}
14
AWS Server Migration Service User Guide
Installing the Server Migration Connector on VMware
]
}
2. Create a local file named role-policy.json with the following content:
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"ec2:ModifyInstanceAttribute",
"ec2:StopInstances",
"ec2:StartInstances",
"ec2:TerminateInstances"
],
"Resource":"*",
"Condition":{
"ForAllValues:StringLike":{
"ec2:ResourceTag/aws:cloudformation:stackid":"arn:aws:cloudformation:*:*:stack/sms-app-*/*"
}
}
},
{
"Effect":"Allow",
"Action":"ec2:CreateTags",
"Resource":"arn:aws:ec2:*:*:instance/*"
},
{
"Effect":"Allow",
"Action":[
"ec2:RunInstances",
"ec2:Describe*"
],
"Resource":"*"
}
]
}
3. At a command prompt, go to the directory where you stored the two JSON policy files, and run the
following commands to create the AWS SMS service role:
aws iam create-role --role-name sms-launch --assume-role-policy-document file://trustpolicy.json
aws iam put-role-policy --role-name sms-launch --policy-name sms --policy-document
file://role-policy.json
Installing the Server Migration Connector on
VMware
This topic describes the steps for setting up AWS SMS to migrate VMs from VMware to Amazon EC2.
This information applies only to VMs in an on-premises VMware environment. For information about
migrating VMs from Hyper-V, see Installing the Server Migration Connector on Hyper-V (p. 18).
From a client computer system on your LAN, complete the following steps to set up the AWS Server
Migration Connector in your VMware environment. The following procedure assumes that you have
already completed Configure AWS SMS Permissions and Roles (p. 10).
15
AWS Server Migration Service User Guide
Installing the Server Migration Connector on VMware
To set up the connector for a VMware environment
1. Open the AWS Server Migration Service console and choose Connectors, SMS Connector setup
guide.
2. On the AWS Server Migration Connector setup page, choose Download OVA to download the
connector for VMware environments. You can also download the connector using the URL provided.
The connector is a preconfigured FreeBSD VM in OVA format that is ready for deployment in your
vCenter.
3. Set up your vCenter service account. Create a vCenter user with permissions necessary to create and
delete snapshots on VMs that need be migrated to AWS and download their delta disks.
Note
As a best practice, we recommend that you limit vCenter permissions for the connector
service account to only those vCenter data centers that contain the VMs that you intend to
migrate. We also recommend that you lock down your vCenter service account permissions
by assigning this user the NoAccess role in vCenter on the hosts, folders, and datastores
that do not have any VMs for migration.
4. Create a role in vCenter with the following privileges:
• Datastore > Browse datastore and Low level file operations (Datastore.Browse and
Datastore.FileManagement)
• Host > Configuration > System Management (Host.Config.SystemManagement)
• vApp > Export (VApp.Export)
• Virtual Machine > Snapshot management > Create snapshot and Remove Snapshot
(VirtualMachine.State.CreateSnapshot and VirtualMachine.State.RemoveSnapshot)
5. Assign the role as follows:
a. Assign this vCenter role to the service account for the connector to use to log in to vCenter.
b. Assign this role with propagating permissions to the data centers that contain the VMs to
migrate.
6. To manually verify your vCenter service account’s permissions, verify that you can log in to vSphere
Client with your connector service account credentials. Then, export your VMs as OVF templates,
use the datastore browser to download files off the datastores that contain your VMs, and view the
properties on the Summary tab of the ESXi hosts of your VMs.
To configure the connector
1. Deploy the connector OVA downloaded in the previous procedure to your VMware environment
using vSphere Client.
2. Open the connector's virtual machine console and log in as ec2-user with the password ec2pass.
Supply a new password if prompted.
3. Obtain the IP address of the connector as follows:
a. Run the command sudo setup.rb. This displays a configuration menu:
Choose one of the following options:
1. Reset password
2. Reconfigure network settings
3. Restart services
4. Factory reset
5. Delete unused upgrade-related files
6. Enable/disable SSL certificate validation
7. Display connector's SSL certificate
8. Generate log bundle
0. Exit
16
AWS Server Migration Service User Guide
Installing the Server Migration Connector on VMware
Please enter your option [1-9]:
b. Enter option 2. This displays current network information and a submenu for making changes to
the network settings. The output should resemble the following:
Current network configuration: DHCP
IP: 192.0.2.100
Netmask: 255.255.254.0
Gateway: 192.0.2.1
DNS server 1: 192.0.2.200
DNS server 2: 192.0.2.201
DNS suffix search list: subdomain.example.com
Web proxy: not configured
Reconfigure your network:
1. Renew or acquire a DHCP lease
2. Set up a static IP
3. Set up a web proxy for AWS communication
4. Set up a DNS suffix search list
5. Exit
Please enter your option [1-5]:
You need to enter this IP address in later procedures.
4. [Optional] Configure a static IP address for the connector. This prevents you from having to
reconfigure the trusted hosts lists on your LAN each time DHCP assigns a new address to the
connector.
In the Reconfigure your network menu, enter option 2. This displays a form to supply network
settings:
For each field, provide an appropriate value and press Enter. You should see output similar to the
following:
Setting up static IP:
1. Enter IP address: 192.0.2.50
2. Enter netmask: 255.255.254.0
3. Enter gateway: 192.0.2.1
4. Enter DNS 1: 192.0.2.200
5. Enter DNS 2: 192.0.2.201
Static IP address configured.
5. In the connector's network configuration menu, configure domain suffix values for the DNS suffix
search list.
6. If your environment uses a web proxy to reach the internet, configure that now.
7. Before leaving the connector console, use ping to verify network access to the following targets
inside and outside your LAN:
• Inside your LAN, to your ESXi hosts and vCenter by hostname, FQDN, and IP address
• Outside your LAN, to AWS
8. In a web browser, access the connector VM at its IP address (https://ip-address-of-connector/)
to open the setup wizard, and choose Get started now.
9. Review the license agreement, select the check box, and choose Next.
10. Create a password for the connector.
11. Choose Upload logs automatically and Server Migration Connector auto-upgrade.
12. For AWS Region, choose your Region from the list. For AWS Credentials, enter the IAM credentials
that you created in Configure AWS SMS Permissions and Roles (p. 10). Choose Next.
17
AWS Server Migration Service User Guide
Installing the Server Migration Connector on Hyper-V
13. For vCenter Service Account, enter the vCenter hostname, user name, and password from step 3.
Choose Next.
14. After accepting the vCenter certificate, complete registration and then view the connector
configuration dashboard.
15. Verify that the connector you registered shows up on the Connectors page.
Installing the Server Migration Connector on
Hyper-V
This topic describes the steps for setting up AWS SMS to migrate VMs from Hyper-V to Amazon EC2.
This information applies only to VMs in an on-premises Hyper-V environment. For information about
migrating VMs from VMware, see Installing the Server Migration Connector on VMware (p. 15).
AWS SMS supports migration in either of two modes: from standalone Hyper-V servers, or from HyperV servers managed by System Center Virtual Machine Manager (SCVMM). The following sections describe
the configuration common to both scenarios, followed by instructions to install and configure the AWS
Server Migration Connector in your particular on-premises environment.
Considerations for migration scenarios
• The installation procedures for standalone Hyper-V and for SCVMM environments are not
interchangeable.
• When configured in SCVMM mode, one Server Migration Connector appliance supports migration from
one SCVMM (which may manage multiple Hyper-V servers).
• When configured in standalone Hyper-V mode, one Server Migration Connector appliance supports
migration from multiple Hyper-V servers.
• AWS SMS supports deploying any number of connector appliances to support migration from multiple
SCVMMs and multiple standalone Hyper-V servers in parallel.
All of the following procedures in this topic assume that you have created a properly configured IAM user
as described in Configure AWS SMS Permissions and Roles (p. 10).
Contents
• About the Server Migration Connector Installation Script (p. 18)
• Step 1: Create a Service Account for Server Migration Connector in Active Directory (p. 19)
• Step 2: Download and Deploy the Server Migration Connector (p. 20)
• Step 3: Download and Install the Hyper-V/SCVMM Configuration Script (p. 21)
• Step 4: Validate the Integrity and Cryptographic Signature of the Script File (p. 22)
• Step 5: Run the Script (p. 23)
• Step 6: Configure the Connector (p. 24)
About the Server Migration Connector Installation
Script
The AWS SMS configuration script automates creation of appropriate permissions and network
connections that allow AWS SMS to execute tasks on your Hyper-V environment. You must run the script
as administrator on each Hyper-V and SCVMM host that you plan to use in migrating VMs. When you run
the script, it performs the following actions:
18
AWS Server Migration Service User Guide
Step 1: Create a Service Account for Server
Migration Connector in Active Directory
1. [All systems] Checks whether the Windows Remote Management (WinRM) service is enabled on
SCVMM and all Hyper-V hosts, enables it if necessary, and sets it to start automatically on boot.
2. [All systems] Enables PowerShell remoting, which allows the connector to execute PowerShell
commands on that host over a WinRM connection.
3. [All systems] Creates a self-signed X.509 certificate, creates a WinRM HTTPS listener, and binds the
certificate to the listener.
4. [All systems] Creates a firewall rule to accept incoming connections to the WinRM listener.
5. [All systems] Adds the IP address or domain name of the connector to the list of trusted hosts in the
WinRM configuration. You must have this IP address or domain name configured before running the
script so that you can provide it interactively.
6. [All systems] Enables Credential Security Support Provider (CredSSP) authentication with WinRM.
7. [All systems] Grants read and execute permissions to a pre-configured Active Directory user on
WinRM configSDDL. This user is the same as the service account described below in Step 1: Create a
Service Account for Server Migration Connector in Active Directory (p. 19).
8. [Standalone Hyper-V only] Adds the Active Directory user to the groups Hyper-V Administrators and
Remote Management Users on your Hyper-V host.
9. [Standalone Hyper-V only] Gives read-only permissions to all VM data folders manged by this HyperV.
10.[SCVMM only] Grants "Execute Methods," "Enable Account," and "Remote Enable" permissions to the
Active Directory user on two WMI objects, CIMV2 and SCVMM.
11.[SCVMM only] Creates a Delegated Administrator role in SCVMM with permissions to access all HyperV hosts. It assigns the role to the Active Directory user. You can selectively remove access to hosts by
editing this role in SCVMM.
12.[SCVMM only] Checks whether a secure (HTTPS) network path exists between SCVMM and the HyperV hosts. If the script does not detect a secure channel, it returns an error and generates instructions
for the administrator to secure the channel.
13.[SCVMM only] Iterates through all the Hyper-V hosts managed by SCVMM and grants the Active
Directory user read-only permissions on all VM folders on each Hyper-V host.
Step 1: Create a Service Account for Server Migration
Connector in Active Directory
The Server Migration Connector requires a service account in Active Directory. As the connector
configuration script is run on each SCVMM and Hyper-V host, it grants permissions on those hosts to this
account.
Note
When configured in SCVMM mode, the SCVMM host and all the Hyper-V hosts that it manages
must be located in a single Active Directory domain. If you have multiple Active Directory
domains, configure a connector for each.
To create the Active Directory user
1. Using the Active Directory Administrative Center on the Windows computer where your Active
Directory forest is installed, create a new user and assign a password to it.
2. Add the new user to the Remote Management Users group.
19
AWS Server Migration Service User Guide
Step 2: Download and Deploy
the Server Migration Connector
Step 2: Download and Deploy the Server Migration
Connector
Download the Server Migration Connector for Hyper-V and SCVMM to your on-premises environment
and install it on a Hyper-V host.
Note
This connector is meant only for installation in a Hyper-V environment. For information
about installing in a VMware environment, see Installing the Server Migration Connector on
VMware (p. 15).
To set up the connector for a Hyper-V environment
1. Open the AWS Server Migration Service console and choose Connectors,SMS Connector setup
guide.
2. On the AWS Server Migration Connector setup page, choose Download VHD ZIP to download the
connector for Hyper-V.
3. Transfer the downloaded connector file to your Hyper-V host, unzip it, and import the connector as
a VM.
4. Open the connector's virtual machine console and log in as ec2-user with the password ec2pass.
Supply a new password if prompted.
5. Obtain the IP address of the connector as follows:
a. Run the command sudo setup.rb. This displays a configuration menu:
Choose one of the following options:
1. Reset password
2. Reconfigure network settings
3. Restart services
4. Factory reset
5. Delete unused upgrade-related files
6. Enable/disable SSL certificate validation
7. Display connector's SSL certificate
8. Generate log bundle
0. Exit
Please enter your option [1-9]:
b. Enter option 2. This displays current network information and a submenu for making changes to
the network settings. The output should resemble the following:
Current network configuration: DHCP
IP: 192.0.2.100
Netmask: 255.255.254.0
Gateway: 192.0.2.1
DNS server 1: 192.0.2.200
DNS server 2: 192.0.2.201
DNS suffix search list: subdomain.example.com
Web proxy: not configured
Reconfigure your network:
1. Renew or acquire a DHCP lease
2. Set up a static IP
3. Set up a web proxy for AWS communication
4. Set up a DNS suffix search list
5. Exit
Please enter your option [1-5]:
20
AWS Server Migration Service User Guide
Step 3: Download and Install the
Hyper-V/SCVMM Configuration Script
You need to enter this IP address in later procedures.
6. [Optional] Configure a static IP address for the connector. This prevents you from having to
reconfigure the trusted hosts lists on your LAN each time DHCP assigns a new address to the
connector.
In the Reconfigure your network menu, enter option 2. This displays a form to supply network
settings:
For each field, provide an appropriate value and press Enter. You should see output similar to the
following:
Setting up static IP:
1. Enter IP address: 192.0.2.50
2. Enter netmask: 255.255.254.0
3. Enter gateway: 192.0.2.1
4. Enter DNS 1: 192.0.2.200
5. Enter DNS 2: 192.0.2.201
Static IP address configured.
7. In the connector's network configuration menu, configure domain suffix values for the DNS suffix
search list.
8. If your environment uses a web proxy to reach the internet, configure that now.
9. Before leaving the connector console, use ping to verify network access to the following targets
inside and outside your LAN:
• Inside your LAN, to your Hyper-V hosts and SCVMM by hostname, FQDN, and IP address
• Outside your LAN, to AWS
Step 3: Download and Install the Hyper-V/SCVMM
Configuration Script
AWS SMS provides a downloadable PowerShell script to configure the Windows environment to support
communications with the Server Migration Connector. The same script is used for configuring either
standalone Hyper-V or SCVMM. The script is cryptographically signed by AWS.
Download the script and hash files from the following URLs:
File URL
Installation
script
https://s3.amazonaws.com/sms-connector/aws-sms-hyperv-setup.ps1
MD5 hash https://s3.amazonaws.com/sms-connector/aws-sms-hyperv-setup.ps1.md5
SHA256 hash https://s3.amazonaws.com/sms-connector/aws-sms-hyperv-setup.ps1.sha256
After download, transfer the downloaded files to the computer or computers where you plan to run the
script.
21
AWS Server Migration Service User Guide
Step 4: Validate the Integrity and
Cryptographic Signature of the Script File
Step 4: Validate the Integrity and Cryptographic
Signature of the Script File
Before running the script, we recommend that you validate its integrity and signature. These procedures
assume that you have downloaded the script and the hash files, that they are installed on the desktop of
the computer where you plan to run the script, and that you are signed in as the administrator. You may
need to modify the procedures to match your setup.
To validate script integrity using cryptographic hashes (PowerShell)
1. Use one or both of the downloaded hash files to validate the integrity of the script file, ensuring
that it has not changed in transit to your computer.
a. To validate with the MD5 hash, run the following command in a PowerShell window:
PS C:\Users\Administrator\Desktop> Get-FileHash aws-sms-hyperv-setup.ps1 -Algorithm
MD5
This should return information similar to the following:
Algorithm Hash
--------- ----
MD5 1AABAC6D068EEF6EXAMPLEDF50A05CC8
b. To validate with the SHA256 hash, run the following command in a PowerShell window:
PS C:\Users\Administrator\Desktop> Get-FileHash aws-sms-hyperv-setup.ps1 -Algorithm
SHA256
This should return information similar to the following:
Algorithm Hash
--------- ----
SHA256 6B86B273FF34FCE19D6B804EFF5A3F574EXAMPLE22F1D49C01E52DDB7875B4B
c.
2. Compare the returned hash values with the values provided in the downloaded files, aws-smshyperv-setup.ps1.md5 and aws-sms-hyperv-setup.ps1.sha256.
Next, use either the Windows user interface or PowerShell to check that the script file includes a valid
signature from AWS.
To check the script file for a valid cryptographic signature (Windows GUI)
1. In Windows Explorer, open the context (right-click) menu on the script file and choose Properties,
Digital Signatures, Amazon Web Services, and Details.
2. Verify that the displayed information contains "This digital signature is OK" and that "Amazon Web
Services, Inc." is the signer.
To check the script file for a valid cryptographic signature (PowerShell)
• In a PowerShell window, run the following command:
22
AWS Server Migration Service User Guide
Step 5: Run the Script