How do I update yum or install packages without internet access on my EC2 instances that run Amazon Linux?

Short description

Amazon Linux repositories are hosted in Amazon Simple Storage Service (Amazon S3) buckets. To update and install packages on your instance without an internet connection, create an Amazon Virtual Private Cloud (Amazon VPC) gateway endpoint for Amazon S3. Include a policy in the VPC endpoint that allows access to the repository buckets. Then, associate the VPC endpoint with your instance subnet's routing table.

Note: To activate third-party repositories, such as Extra Packages for Enterprise Linux (EPEL), your instance must have internet access through one of the following devices:

• NAT gateway
• NAT instance
• Internet gateway
• AWS VPN or AWS Direct Connect connection to your data center that routes the yum request through the public internet

Resolution

Check your configuration

Make sure that the security group that's attached to your instance allows outbound HTTP and HTTPS traffic. The security group that's attached to your VPC endpoint for Amazon S3 must allow inbound HTTP traffic from your instance's subnet.

Also, check the network access control list (network ACL) that's associated with your instance's subnet. The network ACL must allow outbound traffic on ports 80 (HTTP) and 443 (HTTPS) to the AWS Region of your Amazon S3 service. The network ACL must also allow inbound traffic on ephemeral TCP ports (1024-65535) from the Region of the Amazon S3 service. The Region of the Amazon S3 service is the public IP address CIDR for the Amazon S3 service. You can't use prefix lists in network ACLs. Instead, use 0.0.0.0/0 to add the Amazon S3 CIDR to your network ACL. You can also use the actual Amazon S3 CIDRs in the network ACL. However, the Amazon S3 CIDRs might change.

Create the VPC endpoints

Complete the following steps:

1. Open the Amazon EC2 console.

2. Select your instance.

3. Choose the Networking tab, and then note the VPC ID and Subnet ID values.

4. Open the Amazon VPC console.

5. Choose Subnets, and then select your subnet ID.

6. Choose the Route table tab, and then note the Route table ID value.

7. Choose Endpoints, and then choose Create endpoint.

8. To create the gateway endpoint, configure the following settings:
   For Region, select the Region code for where you want to create your endpoint. For example, to create an endpoint in us-east-1, select com.amazonaws.us-east-1.s3.
   For VPC, select the VPC ID for your instance.
   For Configure route tables, select the route table ID for your instance.
   For Policy, choose Full Access to allow full access to Amazon S3. If you choose Custom, then you must allow the s3:GetObject API call on the Amazon Linux repositories buckets.
   Note: In the following example policies, replace us-east-1 with your endpoint Region.
   AL2023:

   {  "Statement": [
       {
         "Principal": "*",
         "Action": [
           "s3:GetObject"
         ],
         "Effect": "Allow",
         "Resource": [
           "arn:aws:s3:::al2023-repos-us-east-1-de612dc2/*"
         ]
       }
     ]
   }

   AL2:

   {  "Statement": [
       {
         "Principal": "*",
         "Action": [
           "s3:GetObject"
         ],
         "Effect": "Allow",
         "Resource": [
           "arn:aws:s3:::amazonlinux.us-east-1.amazonaws.com/*",
           "arn:aws:s3:::amazonlinux-2-repos-us-east-1/*"
         ]
       }
     ]
   }

   AL1:

   {  "Statement": [
       {
         "Principal": "*",
         "Action": [
           "s3:GetObject"
         ],
         "Effect": "Allow",
         "Resource": [
           "arn:aws:s3:::packages.us-east-1.amazonaws.com/*",
           "arn:aws:s3:::repo.us-east-1.amazonaws.com/*"
         ]
       }
     ]
   }

   Note: In the preceding AL1 and AL2 policies, the arn:aws:s3:::amazonlinux.us-east-1.amazonaws.com/* and arn:aws:s3:::amazonlinux-2-repos-us-east-1/* buckets host the repositories.

9. Choose Create endpoint.

After you create the VPC endpoint, you can install and update packages in your Amazon Linux instance.

Related information

Why do I receive errors when I use yum on my EC2 instance that runs Amazon Linux 1, Amazon Linux 2, or Amazon Linux 2023?

Gateway endpoints for Amazon S3