跳至主要內容

在 AWS 使用官方 Rocky Linux 映像

· 5 分鐘閱讀
ひかり

AMI 的選擇方式​

從官方頁面取得 AMI。

https://rockylinux.org/ja-JP/download

選擇要設定給實例的架構 (ARM (aarch64))，並選擇 Cloud Images 裡的 AWS AMI。

alt text

以版本號過濾，找到符合條件的映像。

alt text

AMI ID 無法直接複製，因此點擊 Deploy 按鈕，然後從 AWS 主控台複製。

用 AMI ID 搜尋會出現如下

alt text

用擁有者過濾會比較好。

擁有者 = 792107900819

alt text

事前準備​

  • 註冊 Key pair
    • 事先執行 ssh-keygen -t ed25519 指令產生公鑰，將 .ssh/id_ed25519.pub 匯入成 Key pair
  • 安裝 AWS CLI
    • 安裝 CLI
    • 設定存取金鑰 (aws configure)

建立網路​

比起 NAT Gateway，使用公開 IP 比較便宜，所以建立 Elastic IP。

架構圖大概長這樣。

建立 EC2 Instance Connect 端點​

alt text

建立 EC2 Instance Connect 端點後，可以從 AWS CLI 登入。

建立實例​

  • 為了接受 ping 要允許 ICMP（Echo Request）（安全性群組）
  • 允許 SSH 連線（安全性群組）
  • 在孟買區域 (Mumbai) 且 arm64 比較便宜
  • 每 vCPU 需要 1.5 GiB RAM（至少 t4g.medium）

因此我用以下條件建立。

  • 區域：孟買（ap-south-1）
  • 架構：arm64
  • AMI：RHEL 8.10 (LVM, aarch64); ami-0415efd8380284dc4
  • 實例類型：t4g.medium
  • Key pair：在 PC 上建立的公鑰 (.ssh/id_ed25519.pub)
  • 網路：公共子網（關聯了到 Internet Gateway 的路由表）
  • 安全性群組：建立安全性群組（名稱為預設）
    • ssh, 0.0.0.0/0
    • 自訂 ICMP - IPv4（Echo Request）, 0.0.0.0/0
  • 儲存：1x 10GiB, gp3

連線​

在 PC 上打開終端機，執行以下指令。

aws ec2-instance-connect ssh --private-key-file .ssh/id_ed25519 --os-user rocky --instance-id i-*****************

安裝 Instance Connect 套件​

Rocky Linux 的 AMI 映像沒有包含 Instance Connect 套件，無法從管理控制台連線。因此需要安裝套件。

參考 https://docs.aws.amazon.com/ja_jp/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html 下載套件。

  • ※選擇 RHEL 的套件
  • ※注意作業系統主版本與架構不同可能無法正常運作

範例​

curl https://amazon-ec2-instance-connect-us-west-2.s3.us-west-2.amazonaws.com/latest/linux_arm64/ec2-instance-connect.rhel8.rpm -o /tmp/ec2-instance-connect.rpm
curl https://amazon-ec2-instance-connect-us-west-2.s3.us-west-2.amazonaws.com/latest/linux_amd64/ec2-instance-connect-selinux.noarch.rpm -o /tmp/ec2-instance-connect-selinux.rpm
sudo dnf install -y /tmp/ec2-instance-connect.rpm /tmp/ec2-instance-connect-selinux.rpm

安裝完成後，就可以從 AWS 管理控制台存取。

alt text

CDK (typescript)​

我做了 CDK 範例，放上來供參考。

請記得更改 keyName（Key pair）的名稱。

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

export interface RockyLinuxStackProps extends cdk.StackProps {
}

export class RockyLinuxStack extends cdk.Stack {
  public constructor(scope: cdk.App, id: string, props: RockyLinuxStackProps = {}) {
    super(scope, id, props);

    // Resources
    const ec2dhcpOptions = new ec2.CfnDHCPOptions(this, 'EC2DHCPOptions', {
      domainName: 'ap-south-1.compute.internal',
      domainNameServers: [
        'AmazonProvidedDNS',
      ],
            ],
    });
    ec2dhcpOptions.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2InternetGateway = new ec2.CfnInternetGateway(this, 'EC2InternetGateway', {
              {
          value: 'igw',
          key: 'Name',
        },
      ],
    });
    ec2InternetGateway.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2vpc = new ec2.CfnVPC(this, 'EC2VPC', {
      cidrBlock: '10.0.0.0/16',
      enableDnsSupport: true,
      instanceTenancy: 'default',
      enableDnsHostnames: true,
              {
          value: 'vpc',
          key: 'Name',
        },
      ],
    });
    ec2vpc.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2VPCGatewayAttachment = new ec2.CfnVPCGatewayAttachment(this, 'EC2VPCGatewayAttachment', {
      vpcId: ec2vpc.ref,
      internetGatewayId: ec2InternetGateway.ref,
    });
    ec2VPCGatewayAttachment.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2NetworkAcl = new ec2.CfnNetworkAcl(this, 'EC2NetworkAcl', {
      vpcId: ec2vpc.ref,
            ],
    });
    ec2NetworkAcl.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2RouteTable = new ec2.CfnRouteTable(this, 'EC2RouteTable', {
      vpcId: ec2vpc.ref,
    });
    ec2RouteTable.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2SecurityGroup = new ec2.CfnSecurityGroup(this, 'EC2SecurityGroup', {
      groupDescription: 'launch-wizard-1 created 2025-04-27T00:11:58.641Z',
      groupName: 'launch-wizard-1',
      vpcId: ec2vpc.ref,
      securityGroupIngress: [
        {
          cidrIp: '0.0.0.0/0',
          ipProtocol: 'tcp',
          fromPort: 22,
          toPort: 22,
        },
        {
          cidrIp: '0.0.0.0/0',
          ipProtocol: 'icmp',
          fromPort: 8,
          toPort: -1,
        },
      ],
      securityGroupEgress: [
        {
          cidrIp: '0.0.0.0/0',
          ipProtocol: '-1',
          fromPort: -1,
          toPort: -1,
        },
      ],
    });
    ec2SecurityGroup.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2Subnet = new ec2.CfnSubnet(this, 'EC2Subnet', {
      vpcId: ec2vpc.ref,
      mapPublicIpOnLaunch: false,
      enableDns64: false,
      availabilityZoneId: 'aps1-az1',
      privateDnsNameOptionsOnLaunch: {
        EnableResourceNameDnsARecord: false,
        HostnameType: 'ip-name',
        EnableResourceNameDnsAAAARecord: false,
      },
      cidrBlock: '10.0.0.0/20',
      ipv6Native: false,
              {
          value: 'subnet-public1-ap-south-1a',
          key: 'Name',
        },
      ],
    });
    ec2Subnet.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2InstanceConnectEndpoint = new ec2.CfnInstanceConnectEndpoint(this, 'EC2InstanceConnectEndpoint', {
      preserveClientIp: false,
      securityGroupIds: [
        ec2SecurityGroup.attrGroupId,
      ],
      subnetId: ec2Subnet.attrSubnetId,
    });
    ec2InstanceConnectEndpoint.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2vpcdhcpOptionsAssociation = new ec2.CfnVPCDHCPOptionsAssociation(this, 'EC2VPCDHCPOptionsAssociation', {
      vpcId: ec2vpc.ref,
      dhcpOptionsId: ec2dhcpOptions.ref,
    });
    ec2vpcdhcpOptionsAssociation.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2RouteHg = new ec2.CfnRoute(this, 'EC2RouteHG', {
      routeTableId: ec2RouteTable.ref,
      destinationCidrBlock: '0.0.0.0/0',
      gatewayId: ec2InternetGateway.ref,
    });
    ec2RouteHg.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2SubnetNetworkAclAssociation = new ec2.CfnSubnetNetworkAclAssociation(this, 'EC2SubnetNetworkAclAssociation', {
      networkAclId: ec2NetworkAcl.ref,
      subnetId: ec2Subnet.ref,
    });
    ec2SubnetNetworkAclAssociation.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2SubnetRouteTableAssociation = new ec2.CfnSubnetRouteTableAssociation(this, 'EC2SubnetRouteTableAssociation', {
      routeTableId: ec2RouteTable.ref,
      subnetId: ec2Subnet.ref,
    });
    ec2SubnetRouteTableAssociation.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2Instance = new ec2.CfnInstance(this, 'EC2Instance', {
      tenancy: 'default',
      instanceInitiatedShutdownBehavior: 'stop',
      cpuOptions: {
        threadsPerCore: 1,
        coreCount: 2,
      },
      blockDeviceMappings: [
        {
          ebs: {
            volumeType: 'gp3',
            iops: 3000,
            volumeSize: 10,
            encrypted: false,
            deleteOnTermination: true,
          },
          deviceName: '/dev/sda1',
        },
      ],
      availabilityZone: 'ap-south-1a',
      privateDnsNameOptions: {
        enableResourceNameDnsARecord: false,
        hostnameType: 'ip-name',
        enableResourceNameDnsAaaaRecord: false,
      },
      ebsOptimized: true,
      disableApiTermination: false,
      keyName: 'hikari',
      sourceDestCheck: true,
      placementGroupName: '',
      networkInterfaces: [
        {
          privateIpAddresses: [
            {
              privateIpAddress: '10.0.3.59',
              primary: true,
            },
          ],
          secondaryPrivateIpAddressCount: 0,
          deviceIndex: '0',
          groupSet: [
            ec2SecurityGroup.ref,
          ],
          ipv6Addresses: [
          ],
          subnetId: ec2Subnet.ref,
          associatePublicIpAddress: true,
          deleteOnTermination: true,
        },
      ],
      imageId: 'ami-0415efd8380284dc4',
      instanceType: 't4g.medium',
      monitoring: false,
            ],
      creditSpecification: {
        cpuCredits: 'unlimited',
      },
    });
    ec2Instance.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2ElasticIp = new ec2.CfnEIP(this, 'EC2ElasticIp', {
      domain: 'vpc',
              {
          key: 'Name',
          value: 'elastic-ip',
        },
      ],
    });
    ec2ElasticIp.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;

    const ec2EipAssociation = new ec2.CfnEIPAssociation(this, 'EC2EipAssociation', {
      eip: ec2ElasticIp.ref,
      instanceId: ec2Instance.ref,
    });
    ec2EipAssociation.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.DELETE;
  }
}

コメント

読み込み中...

コメントを投稿する

★★★★★