Import virtual machine to AWS

In this step, you will create an IAM role named vmimport and import the virtual machine that was uploaded to the Amazon S3 bucket in the previous step into an Amazon Machine Image (AMI). The entire process will be performed using the AWS Command Line Interface (CLI).

Create IAM role vmimport

Before importing the virtual machine into AWS, you need to create the necessary IAM role.

1. Create a file named trust-policy.json to allow the VM Import/Export service to assume the vmimport role:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": { "Service": "vmie.amazonaws.com" },
         "Action": "sts:AssumeRole",
         "Condition": {
            "StringEquals":{
               "sts:Externalid": "vmimport"
            }
         }
      }
   ]
}

2. Use the AWS CLI create-role command to create the vmimport IAM role and assign the trust policy:

aws iam create-role --role-name vmimport --assume-role-policy-document "file://trust-policy.json"

3. Check the created role in the IAM console.

4. View the Trust relationships of the role.

5. To grant permissions to the vmimport role, create a text file named role-policy.json. In the JSON content, at the Resource lines (ARN), check and update the exact name of your bucket. Since the S3 bucket name is globally unique, if you changed the bucket name during initialization, make sure the ARN in this file matches that name (example: arn:aws:s3:::your-bucket-name).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::import-bucket-2026-1a",
        "arn:aws:s3:::import-bucket-2026-1a/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject",
        "s3:GetBucketAcl"
      ],
      "Resource": [
        "arn:aws:s3:::export-bucket-2026-1a",
        "arn:aws:s3:::export-bucket-2026-1a/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:ModifySnapshotAttribute",
        "ec2:CopySnapshot",
        "ec2:RegisterImage",
        "ec2:Describe*"
      ],
      "Resource": "*"
    }
  ]
}

6. Attach the policy to the vmimport role using the AWS CLI put-role-policy command:

aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document "file://role-policy.json"

7. Check the role permissions in the IAM console.

Import virtual machine to AMI

Use the AWS CLI to import the virtual machine to AMI:

1. Run the AWS CLI ec2 import-image command:

aws ec2 import-image --description "VM Image" --disk-containers Format=vmdk,UserBucket="{S3Bucket=import-bucket-2026-1a,S3Key=Ubuntu-disk1.vmdk}"

2. The import process may take 5-10 minutes depending on the virtual machine size.
   • Check the status of VM import to Amazon Web Services
   • Check import status

   aws ec2 describe-import-image-tasks --import-task-ids import-ami-xxxxxxxx
   

3. After completion, the new AMI will appear in the AMIs list with the AMI name being the task ID.