Configure EC2 Fast Launch settings for your Amazon EC2 Windows Server AMI
You can configure EC2 Fast Launch for Windows AMIs that you own, or AMIs that are shared with you from the AWS Management Console, API, SDKs, CloudFormation, or AWS Command Line Interface (AWS CLI). Before you configure EC2 Fast Launch, verify that your AMI meets all of the prerequisites that are required to create the pre-provisioned snapshots. For more information, see EC2 Fast Launch prerequisites for Windows.
When you enable faster launching for Windows instances, Amazon EC2 checks to make sure that you have the required permissions to launch instances from the specified AMI and Launch Template (if provided), including permissions for encrypted AMIs. To prevent errors during the instance launch process, the service validates your permissions before EC2 Fast Launch is enabled. If you don't have the required permissions, the service returns an error, and does not enable EC2 Fast Launch.
EC2 Fast Launch integrates with EC2 Image Builder to help you create custom images with EC2 Fast Launch enabled. For more information, see Create distribution settings for a Windows AMI with EC2 Fast Launch enabled (AWS CLI) in the EC2 Image Builder User Guide.
Enable EC2 Fast Launch
Before changing these settings, make sure that your AMI, and the Region that you run in meet all EC2 Fast Launch prerequisites for Windows.
Disable EC2 Fast Launch
Before changing these settings, make sure that your AMI, and the Region that you run in meet all EC2 Fast Launch prerequisites for Windows.
Use a launch template when you set up EC2 Fast Launch
With a launch template, you can configure a set of launch parameters that Amazon EC2 uses each time it launches an instance from that template. You can specify such things as an AMI to use for your base image, instance types, storage, network settings, and more.
Launch templates are optional, except for the following specific cases, where you must use a launch template for your Windows AMI when you configure faster launching:
-
You must use a launch template to specify an existing VPC for your Windows AMI. This doesn't apply if you use the default VPC for your AWS account.
-
If your account includes a policy that enforces IMDSv2 for Amazon EC2 instances, you must create a launch template that specifies the metadata configuration to enforce IMDSv2.
Use the launch template that includes your metadata configuration from the EC2 console, or when you run the enable-fast-launch command in the AWS CLI, or call the EnableFastLaunch API action.
EC2 Fast Launch doesn't support the following configuration when you use a launch template. If you use a launch template for EC2 Fast Launch, you must not specify any of the following:
-
User data scripts
-
Termination protection
-
Disabled metadata
-
Spot option
-
Shutdown behavior that terminates the instance
-
Resource tags for network interface, elastic graphic, or spot instance requests
Specify a VPC
Step 1: Create a launch template
Create a launch template that specifies the following details for your Windows instances:
-
The VPC subnet.
-
An instance type of
t3.xlarge.
For more information, see Create an Amazon EC2 launch template.
Step 2: Specify the launch template for your EC2 Fast Launch AMI
For more information about EC2 launch templates, see Store instance launch parameters in Amazon EC2 launch templates.
Permissions checks for EC2 Fast Launch
When you enable EC2 Fast Launch with a launch template, you can
specify a numbered version of the template. You can also use the
$Latest or $Default version. If you use one of
the aliases, the alias can override the ec2:RunInstances
and iam:PassRole permissions that you intended to
restrict.
When you enable EC2 Fast Launch, Amazon EC2 checks your permissions
against the current launch template version. $Latest and
$Default each resolve to a specific version at that time.
This check runs before
Amazon EC2 enables the feature. It validates the permissions required to
launch instances, such as the ec2:RunInstances and
iam:PassRole permissions. To do this, EC2 Fast Launch
issues a RunInstances dry run call that checks your
permissions without launching an instance. If your permissions don't
allow a required action, Amazon EC2 fails the request and returns an error
that describes the missing permission. Amazon EC2 does not enable
EC2 Fast Launch.
After this initial check is complete, EC2 Fast Launch creates the
pre-provisioned snapshots in the background. It then launches instances
by using the permissions of its service-linked role. Each time it
launches an instance, it uses the version that $Latest or
$Default resolves to at that time. This is true even if
the version has changed after the initial check. It does not recheck
your permissions. As a result, someone who can update the launch
template could pass an IAM role or instance profile to an instance.
This can happen even if they don't have the
iam:PassRole permission for that role.
To make sure that Amazon EC2 always uses the version it validated when you
enabled the feature, specify a numbered launch template version. Do not
use $Latest or $Default.
If you configure EC2 Fast Launch to use the $Latest
or $Default launch template version, we recommend that you
limit who can create and manage launch template versions. Use IAM
policies to restrict access to actions such as
ec2:CreateLaunchTemplateVersion and
ec2:ModifyLaunchTemplate.
