4

I'm launching a Windows 10 EC2 instance and trying to retrieve it's instance-id from the CMD with the command:

curl http://169.254.169.254/latest/meta-data/instance-id

This worked until yesterday, but now it fails every time, raising a Timeout error.

curl: (7) Failed to connect to 169.254.169.254 port 80: Timed out

I've looked up aws's documentation about retrieving EC2 metadata and didn't found anything regarding an expiration time for the retrieving attempt. Also, I've tried to create an AMI from my instance and launch a new instance based on this AMI to try some sort of "refresh" of a possible expiration time, and it didn't worked.

I've searched within the IAM Roles for something related to retrieving metadata permission, but nothing seems to fit my issue.

I've also tried the answers from here but nothing was specific enough to my problem.

What could have happened? This worked for about two months straight and suddenly it stopped working.

Workaround for fixing

Another post, regarding a similar problem, got an answer that fixed my problem.

I simply ran C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeInstance.ps1 and the script applied the default specifications of a newborn EC2 windows instance. I still don't know why this problem happened, but this solution works for someone that doesn't have anything to loose on configuration specifications.

Teodoro
  • 1,194
  • 8
  • 22
  • Expect these requests to be nearly instantaneous. I doubt there's a problem on the EC2 side - I'd put my money on a windows firewall setting of some kind getting turned on. 169.254/16 is a link-local address range , and though using it for ec2 metadata is well within the intended scope of such addresses, Windows often has shall we say, misguided opinions about how to handle it. https://en.wikipedia.org/wiki/Link-local_address – erik258 Dec 26 '19 at 21:46
  • @DanielFarrell hmm, where could I get information on how to prevent windows from barring my access to the address? – Teodoro Dec 26 '19 at 21:53
  • you might have luck on the SuperUser stack exchange site, if you phrase your question as "how can I verify firewall permissions in windows 10" or something. I don't know about such difficult operating systems :P – erik258 Dec 26 '19 at 22:00
  • Another solution to get the Instance ID is via AWS CLI, if you are able to identify the instances using some other tag then ec2 describe-instances cane used to get the instance ID – Lijo Abraham Dec 27 '19 at 06:33
  • Well, I've tried to completely turn off windows firewall, but no luck – Teodoro Dec 27 '19 at 14:36

1 Answers1

2

From the workaround that you shared, it seems the reason why you were not able to get the Instance ID was somehow the routes for your Instance got misconfigured. To retrieve Instance ID from the metadata, the route 169.254.169.254 must point to the right gateway of the Instance. This problem generally occurs with Windows Server 2016 or above when you try to launch an Instance from a custom AMI, in a subnet which is different from the parent Instance from which the AMI was created.

When you ran the command, it scheduled the InitializeInstance.ps1 script, and during the next boot it re-configured the routes.

In, future if you see any such issue, make sure the IP 169.254.169.254 is pointing to the correct gateway, which you can check using the command ipconfig /all and route print commands, in case you find that the routes are mis-configured, you can use the route delete and route add commands with proper parameters to make the routes correct or simply schedule the InitializeInstance.ps1 script, which will correct the routes when the Instance boots up the next time.

Please refer: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch.html

X-Men
  • 433
  • 3
  • 9