View a markdown version of this page

Migrate IIS-hosted applications to Amazon EC2 by using appcmd.exe - AWS Prescriptive Guidance
SummaryPrerequisites and limitationsArchitectureToolsBest practicesEpicsRelated resourcesAdditional information

Migrate IIS-hosted applications to Amazon EC2 by using appcmd.exe

Deepak Kumar, Amazon Web Services

Summary

When you migrate Internet Information Services (IIS)-hosted applications to Amazon Elastic Compute Cloud (Amazon EC2) instances, you need to address several authentication challenges. These challenges include re-entering domain credentials for application pool identities and potentially regenerating machine keys for proper website functionality. This pattern describes a clean migration approach that uses the backup and restore functionality of IIS on Amazon EC2 instances. The approach uses appcmd.exe to uninstall and reinstall IIS on the target Amazon EC2 instances, enabling successful migration of IIS-hosted websites, application pool identities, and machine keys.

Prerequisites and limitations

Prerequisites 

  • An active AWS account for the target server.

  • A functional source IIS server with websites hosted on it.

  • Understanding of IIS working principles, such as administration and configuration.

  • System administrator access on both the source and target servers.

  • Completed migration of the source IIS server to the target AWS account. You can use migration tools such as AWS Transform MGN, an Amazon Machine Image (AMI) snapshot-based approach, or other migration tools.

  • Windows Server 2012 R2 or later on both source and target servers.

  • Microsoft .NET Framework 4.5 or later installed on both servers (required for aspnet_regiis.exe key container operations)

  • A method to transfer backup files and exported key XML files from the source to target server, such as Amazon Simple Storage Service (Amazon S3), a shared network drive, or secure copy.

  • The source and target IIS instances must run the same IIS version (8.5 or 10.0).

Limitations

Product versions

  • IIS 8.5 or IIS 10.0

Architecture

Source technology stack  

  • Windows Server with IIS 8.5 or IIS 10.0 installed

Target technology stack  

  • Windows Server with IIS 8.5 or IIS 10.0 installed

  • AWS Transform MGN

Target architecture

The following diagram shows the workflow and architecture components for this pattern.

Workflow to migrate IIS-hosted applications to Amazon EC2.

The solution includes the following steps:

  1. Install and configure the AWS Replication Agent on the source IIS server in your corporate data center. This agent initiates the replication process and manages data transfer to AWS.

  2. The AWS Replication Agent establishes a secure connection to MGN and begins replicating the source server data, including IIS configurations, websites, and application files.

  3. MGN launches Amazon EC2 instances in the application subnet with the replicated data. The target Amazon EC2 instance runs IIS and contains the migrated applications with their associated Amazon Elastic Block Store (Amazon EBS) volumes. After the initial replication, MGN continues to sync changes until you're ready to cut over to the new environment.

Tools

AWS services

Other tools

  • Internet Information Services (IIS) for Windows Server is a web server with a scalable and open architecture for hosting anything on the Web. IIS provides a set of administration tools, including administration and command line tools (for example, appcmd.exe), managed code and scripting APIs, and Windows PowerShell support.

Best practices

  • Secure exported key files – The XML files that contain the exported private keys should be transferred securely (encrypted in transit) and deleted from boththe source and target servers after a successful migration.

  • Test in a non-production environment – Perform the backup and restore procedure on a test server before running it in production.

  • Document application pool identities – Before migration, record all application pool identity credentials because you must re-enter passwords after the restore.

  • Back up SSL certificates separately – The appcmd.exe backup does not include SSL or TLS certificates. Export these separately using the Certificates MMC snap-in or PowerShell

  • Verify web content files – The IIS configuration backup does not include web application files (wwwroot content). Make sure that these are migrated with the server image through AWS Transform MGN.

Epics

TaskDescriptionSkills required

Create backups of IIS-hosted websites, configuration key, and WAS key.

To create backups for IIS-hosted websites, the configuration key (iisConfigurationKey), and the WAS key (iisWasKey), use appcmd.exe on the source server. Use the following steps:

  1. Open a command prompt as administrator.

  2. Run the following command: cd c:\windows\system32\inetsrv

  3. Run the following command, replacing <backupname> with your value: appcmd.exe add backup "<backupname>

To export the configuration key and the WAS key, do the following:

  1. Create the export directory: mkdir C:\temp

  2. Run the following command: cd c:\windows\Microsoft.NET\Framework64\v4.0.30319

  3. Run the following command: aspnet_regiis.exe -px "iisConfigurationKey" C:\temp\iisConfKey.xml -pri

  4. Run the following command: aspnet_regiis.exe -px "iisWasKey" C:\temp\iisWasKey.xml -pri

IIS Administrator
TaskDescriptionSkills required

Uninstall IIS on the target server.

To uninstall IIS on the target server, use the following steps:

  1. Sign in to the server with administrator rights.

  2. Go to Server manager.

  3. Choose Manage, Remove Roles and features, Next, and Next.

  4. Clear the Web Server (IIS) checkbox and then choose Next, and Next.

  5. Select the Restart destination server automatically checkbox. When the uninstall process is completed, the system reboots.

  6. Validate that IIS uninstalled successfully by going to C:\Windows\System32\inetsrv and confirming that this folder is empty.

IIS Administrator

Install IIS on the target server.

To install IIS on the target server, use the following steps:

  1. Sign in to the server with administrator rights.

  2. Go to Server manager.

  3. Choose Add roles and features, Next, Next, Next, and Next.

  4. Select the Webserver IIS checkbox. When prompted, choose Add features.

  5. Choose all the checkboxes that are shown in App development, Add features, and Select all features. You can select features at a granular level just before the confirmation.

  6. Choose Install.

IIS Administrator
TaskDescriptionSkills required

Restore IIS websites and configuration.

To restore the IIS backups that you created from the source server on the target server, use the following steps:

  1. Create a folder named backup in the C:\windows\system32\inetsrv folder, and then place the source backup folder inside it.

  2. Open a command prompt and run as administrator.

  3. Run the following command: cd C:\windows\system32\inetsrv

  4. Run the following command: C:\windows\system32\inetsrv\appcmd.exe list backup

  5. Run the following command: C:\windows\system32\inetsrv\appcmd.exe restore backup <sourcebackup>

  6. Run the following command: cd c:\windows\Microsoft.NET\Framework64\v4.0.30319

  7. Run the following command: aspnet_regiis.exe -pi "iisConfigurationKey" C:\temp\iisConfKey.xml -exp

  8. Run the following command: aspnet_regiis.exe -pi "iisWasKey" C:\temp\iisWasKey.xml -exp

  9. Reset IIS, and go to Application Pool Identity and Website advanced settings to re-enter the password.

  10. Open IIS Manager and verify that all websites, application pools, and virtual directories are restored.

  11. Browse to each website to confirm it is serving content correctly.

  12. After confirming the restoration is successful, delete the exported key files from C:\temp:

    del C:\temp\iisConfKey.xml

    del C:\temp\iisWasKey.xml

IIS Administrator

Related resources

AWS documentation

AWS Prescriptive Guidance

Microsoft resources

Additional information

  • The appcmd.exe backup includes: application pools, sites, global configuration, and IIS schema. It does not include web content files, SSL certificates, or shared configuration files.

  • For large-scale IIS farm migrations, consider using the PowerShell Web-Administration module for scripted backup and restore operations.