# Use EC2 Fast Launch for your Windows instances When you configure a Windows Server AMI for EC2 Fast Launch, Amazon EC2 creates a set of pre-provisioned snapshots to use for faster launching, as follows. 1. Amazon EC2 launches a set of temporary t3 instances, based on your settings. 1. As each temporary instance completes the standard launch steps, Amazon EC2 creates a pre-provisioned snapshot of the instance. It stores the snapshot in your Amazon S3 bucket. 1. When the snapshot is ready, Amazon EC2 terminates the associated t3 instance to keep resource costs as low as possible. 1. The next time Amazon EC2 launches an instance from the EC2 Fast Launch enabled AMI, it uses one of the snapshots to significantly reduce the time it takes to launch. Amazon EC2 automatically replenishes the snapshots you have on hand as it uses them to launch instances from the EC2 Fast Launch enabled AMI. Any account that has access to an AMI with EC2 Fast Launch enabled can benefit from reduced launch times. When the AMI owner grants access for you to launch instances, the pre-provisioned snapshots come from the AMI owner’s account. If an AMI that supports EC2 Fast Launch is shared with you, you can enable or disable faster launching on the shared AMI yourself. If you enable a shared AMI for EC2 Fast Launch, Amazon EC2 creates the pre-provisioned snapshots directly in your account. If you deplete the snapshots in your account, you can still use snapshots from the AMI owner's account. **Note** EC2 Fast Launch deletes pre-provisioned snapshots as soon as they're consumed by a launch to minimize storage costs and prevent reuse. However, if the deleted snapshots match a retention rule, Recycle Bin automatically retains them. We recommend that you review the scope of your Recycle Bin retention rules so that this doesn't happen. For more information, see [Recycle Bin](https://docs.aws.amazon.com/ebs/latest/userguide/recycle-bin.html) in the *Amazon EBS User Guide*. This feature is not the same as [EBS fast snapshot restore](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-fast-snapshot-restore.html). You must explicitly enable EBS fast snapshot restore on a per-snapshot basis, and it has its own associated costs. The following video demonstrates how to configure your Windows AMI for faster launching with a quick overview of the related key terms and their definitions: [Launching EC2 Windows instances up to 65% faster on AWS](https://www.youtube.com/watch?v=qTWlmhf9I9I). **Resource costs** There is no service charge to configure Windows AMIs for EC2 Fast Launch. However, standard pricing applies for any underlying AWS resources that Amazon EC2 uses. To learn more about associated resource costs and how to manage them, see [Manage costs for EC2 Fast Launch underlying resources](win-fast-launch-manage-costs.md). **Topics** + [ ## Key terms ](#win-fast-launch-key-terms) + [ # EC2 Fast Launch prerequisites for Windows ](win-start-fast-launch-prereqs.md) + [ # Configure EC2 Fast Launch settings for your Amazon EC2 Windows Server AMI ](win-fast-launch-configure.md) + [ # View AMIs with EC2 Fast Launch enabled ](win-view-fast-launch.md) + [ # Manage costs for EC2 Fast Launch underlying resources ](win-fast-launch-manage-costs.md) + [ # Monitor EC2 Fast Launch ](win-fast-launch-monitor.md) + [ # Service-linked role for EC2 Fast Launch ](slr-windows-fast-launch.md) + [ # Troubleshoot Windows EC2 Fast Launch ](win-fast-launch-troubleshoot.md) ## Key terms The EC2 Fast Launch feature uses the following key terms: **Pre-provisioned snapshot** A snapshot of an instance that was launched from a Windows AMI with EC2 Fast Launch enabled, and that has completed the following Windows launch steps, rebooting as required. + Sysprep specialize + Windows Out of Box Experience (OOBE) When these steps are complete, EC2 Fast Launch stops the instance, and creates a snapshot that is later used for faster launching from the AMI, based on your configuration. **Launch frequency** Controls the number of pre-provisioned snapshots that Amazon EC2 can launch within the specified timeframe. When you enable EC2 Fast Launch for your AMI, Amazon EC2 creates the initial set of pre-provisioned snapshots in the background. For example, if the launch frequency is set to five launches per hour, which is the default, then EC2 Fast Launch creates an initial set of five pre-provisioned snapshots. When Amazon EC2 launches an instance from an AMI with EC2 Fast Launch enabled, it uses one of the pre-provisioned snapshots to reduce the launch time. As snapshots are used, they are automatically replenished, up to the number specified by the launch frequency. If you expect a spike in the number of instances that are launched from your AMI – during a special event, for example – you can increase the launch frequency in advance to cover the additional instances that you'll need. When your launch rate returns to normal, you can adjust the frequency back down. When you experience a higher number of launches than anticipated, you might use up all the pre-provisioned snapshots that you have available. This doesn't cause any launches to fail. However, it can result in some instances going through the standard launch process, until snapshots can be replenished. **Target resource count** The number of pre-provisioned snapshots to keep on hand for an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled. **Max parallel launches** Controls how many instances Amazon EC2 can launch at the same time to create the pre-provisioned snapshots for EC2 Fast Launch. If your target resource count is higher than the maximum parallel launches that you've configured, then Amazon EC2 launches the number of instances specified by **Max parallel launches** to start creating the snapshots. As those instances complete the process, Amazon EC2 takes the snapshot and stops the instance. Then it continues to launch more instances until the total number of snapshots available has reached the target resource count. The value for **Max parallel launches** must be 6 or greater. # EC2 Fast Launch prerequisites for Windows Before you set up EC2 Fast Launch, verify that you've met the following prerequisites that are required to create snapshots for the AMIs in your AWS account: + If you provide a custom launch template when you configure EC2 Fast Launch, the service uses the VPC and other configuration settings that you've defined in the launch template. For more information, see [Use a launch template when you set up EC2 Fast Launch](win-fast-launch-configure.md#win-fast-launch-with-template). + If you don't use a custom launch template to configure your settings, you must attach the [EC2FastLaunchFullAccess](security-iam-awsmanpol.md#security-iam-awsmanpol-EC2FastLaunchFullAccess) policy to your current IAM role before you enable EC2 Fast Launch. Then the service automatically creates an CloudFormation stack with the following resources in your AWS account. + A virtual private cloud (VPC) + Private subnets across multiple Availability Zones + A launch template configured with Instance Metadata Service Version 2 (IMDSv2) + A security group with no inbound or outbound rules + Private EC2 Fast Launch AMIs must support user data script execution. + To configure EC2 Fast Launch for an AMI, you must create the AMI using **Sysprep** with the shutdown option. The EC2 Fast Launch feature doesn't currently support AMIs that were created from a running instance. To create an AMI using **Sysprep**, see [Create an Amazon EC2 AMI using Windows Sysprep](ami-create-win-sysprep.md). + To enable EC2 Fast Launch for an [encrypted AMI](AMIEncryption.md) that uses a customer managed key for encryption, you must grant the service-linked role for EC2 Fast Launch permission to use the CMK. For more information, see [Access to customer managed keys](slr-windows-fast-launch.md#win-faster-launching-slr-access-to-cust-keys). + The default quota for **Max parallel launches** across all AMIs in an AWS account is 40 per Region. You can request a Service Quotas increase for your account, as follows. 1. Open the Service Quotas console at [https://console.aws.amazon.com/servicequotas/](https://console.aws.amazon.com/servicequotas/). 1. In the navigation pane, choose AWS services. 1. In the search bar, enter **EC2 Fast Launch**, and select the result. 1. Select the link for **Parallel instance launches** to open the service quota detail page. 1. Choose **Request increase at account level**. For more information, see [Requesting a quota increase](https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html) in the *Service Quotas User Guide*. # Configure EC2 Fast Launch settings for your Amazon EC2 Windows Server AMI You can configure EC2 Fast Launch for Windows AMIs that you own, or AMIs that are shared with you from the AWS Management Console, API, SDKs, CloudFormation, or AWS Command Line Interface (AWS CLI). Before you configure EC2 Fast Launch, verify that your AMI meets all of the prerequisites that are required to create the pre-provisioned snapshots. For more information, see [EC2 Fast Launch prerequisites for Windows](win-start-fast-launch-prereqs.md). When you enable faster launching for Windows instances, Amazon EC2 checks to make sure that you have the required permissions to launch instances from the specified AMI and Launch Template (if provided), including permissions for encrypted AMIs. To prevent errors during the instance launch process, the service validates your permissions before EC2 Fast Launch is enabled. If you don't have the required permissions, the service returns an error, and does not enable EC2 Fast Launch. EC2 Fast Launch integrates with EC2 Image Builder to help you create custom images with EC2 Fast Launch enabled. For more information, see [Create distribution settings for a Windows AMI with EC2 Fast Launch enabled (AWS CLI)](https://docs.aws.amazon.com/imagebuilder/latest/userguide/cr-upd-ami-distribution-settings.html#create-ami-dist-win-fast-launch) in the *EC2 Image Builder User Guide*. ## Enable EC2 Fast Launch Before changing these settings, make sure that your AMI, and the Region that you run in meet all [EC2 Fast Launch prerequisites for Windows](win-start-fast-launch-prereqs.md). ------ #### [ Console ] **To enable EC2 Fast Launch** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, under **Images**, choose **AMIs**. 1. Choose the AMI to update by selecting the check box next to the **Name**. 1. From the **Actions** menu above the list of AMIs, choose **Configure fast launch**. This opens the **Configure fast launch** page, where you configure the settings for EC2 Fast Launch. 1. To start using pre-provisioned snapshots to launch instances from your Windows AMI faster, select the **Enable fast launch for Windows** checkbox. 1. From the **Set anticipated launch frequency** drop-down list, choose a value to specify the number of snapshots that are created and maintained to cover your expected instance launch volume. 1. When you're done making changes, choose **Save changes**. **Note** If you need to use a launch template to specify a VPC, or to configure metadata settings for IMDSv2, see [Use a launch template when you set up EC2 Fast Launch](#win-fast-launch-with-template). ------ #### [ AWS CLI ] **To enable EC2 Fast Launch** Use the following [enable-fast-launch](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-fast-launch.html) command to enable EC2 Fast Launch for the specified AMI, launching six parallel instances for pre-provisioning. ``` aws ec2 enable-fast-launch \ --image-id ami-0abcdef1234567890 \ --max-parallel-launches 6 \ --resource-type snapshot ``` The following is example output. ``` { "ImageId": "ami-0abcdef1234567890", "ResourceType": "snapshot", "SnapshotConfiguration": { "TargetResourceCount": 10 }, "LaunchTemplate": {}, "MaxParallelLaunches": 6, "OwnerId": "0123456789123", "State": "enabling", "StateTransitionReason": "Client.UserInitiated", "StateTransitionTime": "2022-01-27T22:16:03.199000+00:00" } ``` ------ #### [ PowerShell ] **To enable EC2 Fast Launch** Use the [Enable-EC2FastLaunch](https://docs.aws.amazon.com/powershell/latest/reference/items/Enable-EC2FastLaunch.html) cmdlet to enable EC2 Fast Launch for the specified AMI, launching six parallel instances for pre-provisioning. ``` Enable-EC2FastLaunch ` -ImageId ami-0abcdef1234567890 ` -MaxParallelLaunch 6 ` -Region us-west-2 ` -ResourceType snapshot ``` The following is example output. ``` ImageId : ami-0abcdef1234567890 LaunchTemplate : MaxParallelLaunches : 6 OwnerId : 0123456789123 ResourceType : snapshot SnapshotConfiguration : Amazon.EC2.Model.FastLaunchSnapshotConfigurationResponse State : enabling StateTransitionReason : Client.UserInitiated StateTransitionTime : 2/25/2022 12:24:11 PM ``` ------ ## Disable EC2 Fast Launch Before changing these settings, make sure that your AMI, and the Region that you run in meet all [EC2 Fast Launch prerequisites for Windows](win-start-fast-launch-prereqs.md). ------ #### [ Console ] **To disable EC2 Fast Launch** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, under **Images**, choose **AMIs**. 1. Choose the AMI to update by selecting the check box next to the **Name**. 1. From the **Actions** menu above the list of AMIs, choose **Configure fast launch**. This opens the **Configure fast launch** page, where you configure the settings for EC2 Fast Launch. 1. Clear the **Enable fast launch for Windows** checkbox to disable EC2 Fast Launch and to remove pre-provisioned snapshots. This results in the AMI using the standard launch process for each instance, going forward. **Note** When you disable Windows image optimization, any existing pre-provisioned snapshots are automatically deleted. This step must be completed before you can start using the feature again. 1. When you're done making changes, choose **Save changes**. ------ #### [ AWS CLI ] **To disable EC2 Fast Launch** Use the following [disable-fast-launch](https://docs.aws.amazon.com/cli/latest/reference/ec2/disable-fast-launch.html) command to disable EC2 Fast Launch on the specified AMI, and clean up existing pre-provisioned snapshots. ``` aws ec2 disable-fast-launch --image-id ami-01234567890abcedf ``` The following is example output. ``` { "ImageId": "ami-01234567890abcedf", "ResourceType": "snapshot", "SnapshotConfiguration": {}, "LaunchTemplate": { "LaunchTemplateId": "lt-01234567890abcedf", "LaunchTemplateName": "EC2FastLaunchDefaultResourceCreation-a8c6215d-94e6-441b-9272-dbd1f87b07e2", "Version": "1" }, "MaxParallelLaunches": 6, "OwnerId": "0123456789123", "State": "disabling", "StateTransitionReason": "Client.UserInitiated", "StateTransitionTime": "2022-01-27T22:47:29.265000+00:00" } ``` ------ #### [ PowerShell ] **To disable EC2 Fast Launch** Use the [Disable-EC2FastLaunch](https://docs.aws.amazon.com/powershell/latest/reference/items/Disable-EC2FastLaunch.html) cmdlet to disable EC2 Fast Launch on the specified AMI, and clean up existing pre-provisioned snapshots. ``` Disable-EC2FastLaunch -ImageId ami-0abcdef1234567890 ``` The following is example output. ``` ImageId : ami-0abcdef1234567890 LaunchTemplate : Amazon.EC2.Model.FastLaunchLaunchTemplateSpecificationResponse MaxParallelLaunches : 6 OwnerId : 0123456789123 ResourceType : snapshot SnapshotConfiguration : State : disabling StateTransitionReason : Client.UserInitiated StateTransitionTime : 2/25/2022 1:10:08 PM ``` ------ ## Use a launch template when you set up EC2 Fast Launch With a launch template, you can configure a set of launch parameters that Amazon EC2 uses each time it launches an instance from that template. You can specify such things as an AMI to use for your base image, instance types, storage, network settings, and more. Launch templates are optional, except for the following specific cases, where you must use a launch template for your Windows AMI when you configure faster launching: + You must use a launch template to specify an existing VPC for your Windows AMI. This doesn't apply if you use the default VPC for your AWS account. + If your account includes a policy that enforces IMDSv2 for Amazon EC2 instances, you must create a launch template that specifies the metadata configuration to enforce IMDSv2. Use the launch template that includes your metadata configuration from the EC2 console, or when you run the [enable-fast-launch](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-fast-launch.html) command in the AWS CLI, or call the [EnableFastLaunch](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableFastLaunch.html) API action. Amazon EC2 EC2 Fast Launch doesn't support the following configuration when you use a launch template. If you use a launch template for EC2 Fast Launch, you must not specify any of the following: + User data scripts + Termination protection + Disabled metadata + Spot option + Shutdown behavior that terminates the instance + Resource tags for network interface, elastic graphic, or spot instance requests ### Specify a VPC **Step 1: Create a launch template** Create a launch template that specifies the following details for your Windows instances: + The VPC subnet. + An instance type of `t3.xlarge`. For more information, see [Create an Amazon EC2 launch template](create-launch-template.md). **Step 2: Specify the launch template for your EC2 Fast Launch AMI** ------ #### [ Console ] **To specify the launch template for EC2 Fast Launch** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, under **Images**, choose **AMIs**. 1. Choose the AMI to update by selecting the check box next to the **Name**. 1. From the **Actions** menu above the list of AMIs, choose **Configure fast launch**. This opens the **Configure fast launch** page, where you configure the settings for EC2 Fast Launch. 1. The **Launch template** box performs a filtered search that finds launch templates in your account in the current Region that match the text you've entered. Specify all or part of the launch template name or ID in the box to show a list of matching launch templates. For example, if you enter `fast` in the box, Amazon EC2 finds all of the launch templates in your account in the current Region that have "fast" in the name. To create a new launch template, you can choose **Create launch template**. 1. When you select a launch template, Amazon EC2 shows the default version for that template in the **Source template version** box. To specify a different version, highlight the default version to replace it, and enter the version number you want in the box. 1. When you're done making changes, choose **Save changes**. ------ #### [ AWS CLI ] **To specify the launch template for EC2 Fast Launch** Use the [enable-fast-launch](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-fast-launch.html) command with the `--launch-template` option, specifying either the name or the ID of the launch template. ``` --launch-template LaunchTemplateName=my-launch-template ``` ------ #### [ PowerShell ] **To specify the launch template for EC2 Fast Launch** Use the [Enable-EC2FastLaunch](https://docs.aws.amazon.com/powershell/latest/reference/items/Enable-EC2FastLaunch.html) cmdlet with the `-LaunchTemplate_LaunchTemplateId` or `-LaunchTemplate_LaunchTemplateName` parameter. ``` -LaunchTemplate_LaunchTemplateName my-launch-template ``` ------ For more information about EC2 launch templates, see [Store instance launch parameters in Amazon EC2 launch templates](ec2-launch-templates.md). # View AMIs with EC2 Fast Launch enabled You can use the [describe-fast-launch-images](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-fast-launch-images.html) command in the AWS CLI, or the [Get-EC2FastLaunchImage](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2FastLaunchImage.html) Tools for PowerShell Cmdlet to get details for AMIs that have EC2 Fast Launch enabled. Amazon EC2 provides the following details for each Windows AMI that is returned in the results: + The image ID for an AMI with EC2 Fast Launch enabled. + The resource type that is used for pre-provisioning the associated Windows AMI. Supported value: `snapshot`. + The snapshot configuration, which is a group of parameters that configure pre-provisioning for the associated Windows AMI using snapshots. + Launch template information, including the ID, name, and version of the launch template that the associated AMI uses when it launches Window instances from pre-provisioned snapshots. + The maximum number of instances that can be launched at the same time for creating resources. + The owner ID for the associated AMI. This is not populated for AMIs that are shared with you. + The current state of EC2 Fast Launch for the associated AMI. Supported values include: `enabling | enabling-failed | enabled | enabled-failed | disabling | disabling-failed`. **Note** You can also see the current state displayed in the **Manage image optimization** page in the EC2 console, as **Image optimization state**. + The reason that EC2 Fast Launch for the associated AMI changed to the current state. + The time that EC2 Fast Launch for the associated AMI changed to the current state. ------ #### [ AWS CLI ] **To find AMIs configured for EC2 Fast Launch** Use the following [describe-fast-launch-images](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-fast-launch-images.html) command to describe the details for each of the AMIs in the account that are configured for EC2 Fast Launch. In this example, only one AMI in the account is configured for EC2 Fast Launch. ``` aws ec2 describe-fast-launch-images ``` The following is example output. ``` { "FastLaunchImages": [ { "ImageId": "ami-01234567890abcedf", "ResourceType": "snapshot", "SnapshotConfiguration": {}, "LaunchTemplate": { "LaunchTemplateId": "lt-01234567890abcedf", "LaunchTemplateName": "EC2FastLaunchDefaultResourceCreation-a8c6215d-94e6-441b-9272-dbd1f87b07e2", "Version": "1" }, "MaxParallelLaunches": 6, "OwnerId": "0123456789123", "State": "enabled", "StateTransitionReason": "Client.UserInitiated", "StateTransitionTime": "2022-01-27T22:20:06.552000+00:00" } ] } ``` ------ #### [ PowerShell ] **To find AMIs configured for EC2 Fast Launch** Use the following [Get-EC2FastLaunchImage](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2FastLaunchImage.html) cmdlet to describe the details for each of the AMIs in the account that are configured for EC2 Fast Launch. In this example, only one AMI in the account is configured for EC2 Fast Launch. ``` Get-EC2FastLaunchImage -ImageId ami-0abcdef1234567890 ``` The following is example output. ``` ImageId : ami-0abcdef1234567890 LaunchTemplate : Amazon.EC2.Model.FastLaunchLaunchTemplateSpecificationResponse MaxParallelLaunches : 6 OwnerId : 012345678912 ResourceType : snapshot SnapshotConfiguration : State : enabled StateTransitionReason : Client.UserInitiated StateTransitionTime : 2/25/2022 12:54:43 PM ``` ------ # Manage costs for EC2 Fast Launch underlying resources There is no service charge to configure Windows AMIs for EC2 Fast Launch. However, when you enable EC2 Fast Launch for an Amazon EC2 Windows AMI, standard pricing applies for underlying AWS resources that Amazon EC2 uses to prepare and store the pre-provisioned snapshots. You can configure cost allocation tags to help you track and manage the costs that are associated with EC2 Fast Launch resources. For more information about how to configure cost allocation tags, see [Track EC2 Fast Launch costs on your bill](#win-track-fast-launch-costs). The following example demonstrates how the costs associated with EC2 Fast Launch snapshots costs might be allocated. **Example scenario:** The AtoZ Example company has a Windows AMI with a 50 GiB EBS root volume. They enable EC2 Fast Launch for their AMI, and set the target resource count to five. Over the course of a month, using EC2 Fast Launch for their AMI costs them around \$15.00, and the cost breakdown is as follows: 1. When AtoZ Example enables EC2 Fast Launch, Amazon EC2 launches five small instances. Each instance runs through the Sysprep and OOBE Windows launch steps, rebooting as required. This takes several minutes for each instance (time can vary, based on how busy that Region or Availability Zone (AZ) is, and on the size of the AMI). **Costs** + Instance runtime costs (or minimum runtime, if applicable): five instances + Volume costs: five EBS root volumes 1. When the pre-provisioning process completes, Amazon EC2 takes a snapshot of the instance, which it stores in Amazon S3. Snapshots are typically stored for 4–8 hours before they are consumed by a launch. In this case, the cost is roughly \$10.02 to \$10.05 per snapshot. **Costs** + Snapshot storage (Amazon S3): five snapshots 1. After Amazon EC2 takes the snapshot, it stops the instance. At that point, the instance is no longer accruing costs. However EBS volume costs continue to accrue. **Costs** + EBS volumes: costs continue for the associated EBS root volumes. **Note** The costs shown here are for demonstration purposes only. Your costs will vary, depending on your AMI configuration and pricing plan. ## Track EC2 Fast Launch costs on your bill Cost allocation tags can help you organize your AWS bill to reflect the costs associated with EC2 Fast Launch. You can use the following tag that Amazon EC2 adds to the resources it creates when it prepares and stores pre-provisioned snapshots for EC2 Fast Launch: **Tag key:** `CreatedBy`, **Value:** `EC2 Fast Launch` After you activate the tag in the Billing and Cost Management console, and set up your detailed billing report, the `user:CreatedBy` column appears on the report. The column includes values from all services. However, if you download the CSV file, you can import the data into a spreadsheet, and filter for `EC2 Fast Launch` in the value. This information also appears in the AWS Cost and Usage Report when the tag is activated. **Step 1: Activate user-defined cost allocation tags** To include resource tags in your cost reports, you must first activate the tag in the Billing and Cost Management console. For more information, see [Activating User-Defined Cost Allocation Tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/activating-tags.html) in the *AWS Billing and Cost Management User Guide*. **Note** Activation can take up to 24 hours. **Step 2: Set up a cost report** If you already have a cost report set up, a column for your tag appears the next time the report runs after activation is complete. To set up cost reports for the first time, choose one of the following. + See [Setting up a monthly cost allocation report](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/configurecostallocreport.html#allocation-report) in the *AWS Billing and Cost Management User Guide*. + See [Creating Cost and Usage Reports](https://docs.aws.amazon.com/cur/latest/userguide/cur-create.html) in the *AWS Cost and Usage Report User Guide*. **Note** It can take up to 24 hours for AWS to start delivering reports to your S3 bucket. You can configure EC2 Fast Launch for Windows AMIs that you own, or AMIs that are shared with you from the Amazon EC2 console, API, SDKs, [CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-imagebuilder-distributionconfiguration-fastlaunchconfiguration.html), or **ec2** commands in the AWS CLI. The following sections cover configuration steps for the Amazon EC2 console and AWS CLI. You can also create custom Windows AMIs that are configured for EC2 Fast Launch with EC2 Image Builder. For more information, see [Create distribution settings for a Windows AMI with EC2 Fast Launch enabled (AWS CLI)](https://docs.aws.amazon.com/imagebuilder/latest/userguide/cr-upd-ami-distribution-settings.html#cli-create-ami-dist-config-win-fast-launch). # Monitor EC2 Fast Launch This section covers how to monitor the Amazon EC2 Windows Server AMIs in your account that have EC2 Fast Launch enabled. ## Monitor EC2 Fast Launch state changes with EventBridge When the state changes for a Windows AMI with EC2 Fast Launch enabled, Amazon EC2 generates an `EC2 Fast Launch State-change Notification` event. Then Amazon EC2 sends the state change event to Amazon EventBridge (formerly known as Amazon CloudWatch Events). You can create EventBridge rules that trigger one or more actions in response to the state change event. For example, you can create an EventBridge rule that detects when EC2 Fast Launch is enabled and performs the following actions: + Sends a message to an Amazon SNS topic that notifies its subscribers. + Invokes a Lambda function that performs some action. + Sends the state change data to Amazon Data Firehose for analytics. For more information, see [Creating Amazon EventBridge rules that react to events](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-create-rule.html) in the *Amazon EventBridge User Guide*. **State change events** The EC2 Fast Launch feature emits JSON formatted state change events on a best-effort basis. Amazon EC2 sends the events to EventBridge in near real time. This section describes the event fields and shows an example of the event format. **`EC2 Fast Launch State-change Notification`** **imageId** Identifies the AMI with the EC2 Fast Launch state change. **resourceType** The type of resource to use for pre-provisioning. Supported value: `snapshot`. The default value is `snapshot`. **state** The current state of the EC2 Fast Launch feature for the specified AMI. Valid values include the following: + **enabling** – You've enabled the EC2 Fast Launch feature for the AMI, and Amazon EC2 has started creating snapshots for the pre-provisioning process. + **enabling-failed** – Something went wrong that caused the pre-provisioning process to fail the first time that you enabled the EC2 Fast Launch for an AMI. This can happen anytime during the pre-provisioning process. + **enabled** – The EC2 Fast Launch feature is enabled. The state changes to `enabled` as soon as Amazon EC2 creates the first pre-provisioned snapshot for a newly enabled EC2 Fast Launch AMI. If the AMI was already enabled and goes through pre-provisioning again, the state change happens right away. + **enabled-failed** – This state applies only if this is not the first time your EC2 Fast Launch AMI goes through the pre-provisioning process. This can happen if the EC2 Fast Launch feature is disabled and then later enabled again, or if there is a configuration change or other error after pre-provisioning is completed for the first time. + **disabling** – The AMI owner has turned off the EC2 Fast Launch feature for the AMI, and Amazon EC2 has started the clean up process. + **disabled** – The EC2 Fast Launch feature is disabled. The state changes to `disabled` as soon as Amazon EC2 completes the clean up process. + **disabling-failed** – Something went wrong that caused the clean up process to fail. This means that some pre-provisioned snapshots may still remain in the account. **stateTransitionReason** The reason that the state changed for the EC2 Fast Launch AMI. **Note** All fields in this event message are required. The following example shows a newly enabled EC2 Fast Launch AMI that has launched the first instance to start the pre-provisioning process. At this point, the state is `enabling`. After Amazon EC2 creates the first pre-provisioned snapshot, the state changes to `enabled`. ``` { "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "EC2 Fast Launch State-change Notification", "source": "aws.ec2", "account": "123456789012", "time": "2022-08-31T20:30:12Z", "region": "us-east-1", "resources": [ "arn:aws:ec2:us-east-1:123456789012:image/ami-123456789012" ], "detail": { "imageId": "ami-123456789012", "resourceType": "snapshot", "state": "enabling", "stateTransitionReason": "Client.UserInitiated" } } ``` ## Monitor EC2 Fast Launch metrics with CloudWatch Amazon EC2 AMIs with EC2 Fast Launch enabled send metrics to Amazon CloudWatch. You can use the AWS Management Console, the AWS CLI, or an API to list the metrics that EC2 Fast Launch sends to CloudWatch. The `AWS/EC2` namespace includes the following EC2 Fast Launch metrics: | Metric | Description | | --- | --- | | NumberOfAvailableFastLaunchSnapshots | The number of pre-provisioned snapshots available per EC2 Fast Launch enabled AMI. | | NumberOfInstancesFastLaunched | The number of instances per EC2 Fast Launch enabled AMI that were launched from pre-provisioned snapshots. | | NumberOfInstancesNotFastLaunched | The number of instances per EC2 Fast Launch enabled AMI that resulted in a cold boot due to the lack of available pre-provisioned snapshots at launch time. | | FastLaunchSnapshotUsedToRefillStartTime | The timestamp when Amazon EC2 launched a new image from a EC2 Fast Launch enabled AMI to create another snapshot after an existing snapshot was used. | | FastLaunchSnapshotCreationTime | Measures the time it took for Amazon EC2 to launch an instance and create a snapshot for a EC2 Fast Launch enabled AMI. | # Service-linked role for EC2 Fast Launch Amazon EC2 uses service-linked roles for the permissions that it requires to call other AWS services on your behalf. A service-linked role is a unique type of IAM role that is linked directly to an AWS service. Service-linked roles provide a secure way to delegate permissions to AWS services because only the linked service can assume a service-linked role. For more information about how Amazon EC2 uses IAM roles, including service-linked roles, see [IAM roles for Amazon EC2](iam-roles-for-amazon-ec2.md). Amazon EC2 uses the service-linked role named AWSServiceRoleForEC2FastLaunch to create and manage a set of pre-provisioned snapshots that reduce the time it takes to launch instances from your Windows AMI. ## Permissions granted by AWSServiceRoleForEC2FastLaunch The AWSServiceRoleForEC2FastLaunch service-linked role trusts the following service to assume the role: + `ec2fastlaunch.amazonaws.com` Amazon EC2 uses the [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/EC2FastLaunchServiceRolePolicy.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/EC2FastLaunchServiceRolePolicy.html) managed policy to complete the following actions: + **AWS CloudFormation** – Allow EC2 Fast Launch to get a description of associated CloudFormation stacks. + **Amazon CloudWatch** – Post metric data associated with EC2 Fast Launch to the Amazon EC2 namespace. + **Amazon EC2** – Access is granted for EC2 Fast Launch to perform the following actions: + Launch instances from an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled, in order to perform provisioning steps. Additionally specify resource pattern that allows `ec2:RunInstances` for an AMI that's associated with License Manager. + Stop and terminate an instance that was launched by EC2 Fast Launch after it creates the pre-provisioned snapshot. + Describe image and instance type resources used to launch instances from an Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled and create snapshots from them. + Describe launch template resources and launch instances from a launch template. + Describe instances, instance attributes and instance status, volumes and volume attributes. + Describe network interfaces. + Delete resources that EC2 Fast Launch created, including snapshots, launch templates, volumes and network interfaces. + Tag resources that EC2 Fast Launch creates to launch and pre-provision, Windows instances, and create snapshots for the final launch process to consume. + **Amazon EventBridge** – Includes access to create EventBridge event rules and retrieve details about or delete rules that it created. EC2 Fast Launch may also get a list of target services that receive EC2 Fast Launch events that are forwarded based on event rules, and add target services to or remove them from event rules that it created. + **IAM** – Allows EC2 Fast Launch to create the `EC2FastLaunchServiceRolePolicy` service-linked role, to get and use instance profiles whose name contains `ec2fastlaunch`, and to launch instances on your behalf using the instance profile from your launch template. + **AWS KMS** – Includes access to create grants and list grants that were created by EC2 Fast Launch that can be retired. Also to describe or use keys for the purpose of encrypting or decrypting volumes attached to instances that EC2 Fast Launch creates, and to generate data keys that are not plaintext. To view the permissions for this policy, see [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/EC2FastLaunchServiceRolePolicy.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/EC2FastLaunchServiceRolePolicy.html) in the *AWS Managed Policy Reference*. For more information about using managed policies for Amazon EC2, see [AWS managed policies for Amazon EC2](security-iam-awsmanpol.md). ## Create a service-linked role You don't need to create this service-linked role manually. When you start using EC2 Fast Launch for your AMI, Amazon EC2 creates the service-linked role for you, if it doesn't already exist. If the service-linked role is deleted from your account, you can enable EC2 Fast Launch for another Windows AMI to re-create the role in your account. Alternatively, you can disable EC2 Fast Launch for your current AMI, and then enable it again. However, disabling the feature results in your AMI using the standard launch process for all new instances while Amazon EC2 removes all of your pre-provisioned snapshots. After all of the pre-provisioned snapshots are gone, you can enable using EC2 Fast Launch for your AMI again. ## Access to customer managed keys To enable EC2 Fast Launch for an [encrypted AMI](AMIEncryption.md) that uses a customer managed key for encryption, you must grant the AWSServiceRoleForEC2FastLaunch role permission to use the CMK. To do this, call the [create-grant](https://docs.aws.amazon.com/cli/latest/reference/kms/create-grant.html) command. For `--grantee-principal`, specify the ARN for the AWSServiceRoleForEC2FastLaunch role in your account. For `--operations`, specify `CreateGrant`. ``` aws kms create-grant \ --key-id arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab \ --grantee-principal arn:aws:iam::111122223333:role/AWSServiceRoleForEC2FastLaunch \ --operations CreateGrant ``` ## Edit a service-linked role Amazon EC2 does not allow you to edit the AWSServiceRoleForEC2FastLaunch service-linked role. After you create a service-linked role, you can't change the name of the role, because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_update-service-linked-role.html) in the *IAM User Guide*. ## Delete a service-linked role You can delete a service-linked role only after first deleting all of the related resources. This protects the Amazon EC2 resources that are associated with your Amazon EC2 Windows Server AMI with EC2 Fast Launch enabled, because you can't inadvertently remove permission to access the resources. Use the IAM console, the AWS CLI, or the AWS API to delete the **AWSServiceRoleForEC2FastLaunch** service-linked role. For more information, see [Delete a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html#id_roles_manage_delete_slr) in the *IAM User Guide*. ## Supported Regions Amazon EC2 supports the EC2 Fast Launch service-linked role in all of the Regions where the Amazon EC2 service is available. # Troubleshoot Windows EC2 Fast Launch ## Troubleshooting scenarios The following scenarios can help you diagnose and fix common issues that you might encounter when you try to enable EC2 Fast Launch. ### Unable to stop instance for snapshot creation #### Description When you enable EC2 Fast Launch, the service launches a set of instances that are used to create the pre-provisioned snapshots. Each instance is given 30 minutes to complete the process. If any of the instances complete successfully, then the service sets the Fast Launch status for the AMI to `Enabled`. However, if an instance fails to complete the process in the allotted time, and none of the other instances have completed the process, the service terminates all of the instances and sets the Fast Launch status for the AMI to `enabling_failed` and the Fast Launch status reason to the following: ``` Unable to stop instance ID=i-1234567890abcdef0 for snapshot creation. ``` #### Cause Most often, this is caused by trying to enable EC2 Fast Launch for a Windows AMI that was created from a running instance, or an AMI that doesn't meet all of the [EC2 Fast Launch prerequisites](win-start-fast-launch-prereqs.md). #### Solution Ensure that the AMI you use meets all [EC2 Fast Launch prerequisites](win-start-fast-launch-prereqs.md). To configure EC2 Fast Launch for an AMI, you must create the AMI using **Sysprep** with the shutdown option. For more information, see [Create an Amazon EC2 AMI using Windows Sysprep](ami-create-win-sysprep.md). ### You've reached your VPC limit #### Description If you don't use a launch template to specify an existing VPC, and don't have a default VPC defined for your account, the service automatically creates an CloudFormation stack that includes a VPC and other resources, as described in [EC2 Fast Launch prerequisites](win-start-fast-launch-prereqs.md). #### Cause You've reached the maximum number of VPCs that are allowed in your AWS account for the Region, and you have not specified an existing VPC for EC2 Fast Launch to use. This causes the process to fail. #### Solution You can address this issue with either of the following options: + You can request a quota increase + You can provide a launch template that specifies an existing VPC To request an increase to the number of VPCs that your account can define per Region, follow these steps: 1. Open the Service Quotas console at [https://console.aws.amazon.com/servicequotas/](https://console.aws.amazon.com/servicequotas/). 1. In the **Service Console Dashboard**, choose **Amazon Virtual Private Cloud (Amazon VPC)**. This opens the VPC service quotas. 1. Filter on `VPCs per Region` to go directly to the quota. 1. Select **VPCs per Region**, and choose **Request increase at account level**. If you have an urgent quota request, or if your quota increase request is denied, contact Support for assistance. For more information, see [Requesting a quota increase](https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html) in the *Service Quotas User Guide*. ### Insufficient permissions to enable EC2 Fast Launch #### Description When you enable EC2 Fast Launch for the first time without specifying a Launch Template, EC2 Fast Launch creates a service-owned CloudFormation stack with service default resources. However, the CloudFormation templates will fail to deploy if your IAM principal (role or user) lacks the necessary permissions. The log message might look something like the following: ``` Can't enable EC2 Fast Launch. The IAM credentials that you are using do not have sufficient permissions. Attach EC2FastLaunchFullAccess in the IAM console. ``` #### Cause Your IAM user or role lacks the necessary permissions to enable EC2 Fast Launch. #### Solution Verify that your IAM principal (user or role) that enables EC2 Fast Launch has the `EC2FastLaunchFullAccess` policy attached. This AWS managed policy grants full access to all EC2 Fast Launch resources. To view the permissions for this policy, see the [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/EC2FastLaunchFullAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/EC2FastLaunchFullAccess.html) policy in the *AWS Managed Policy Reference*.