Not able to update EC2 Linux instance with command 'sudo yum update' - amazon-web-services

Question

When I try to update EC2 Amazon Linux instance, I get following error:
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Could not retrieve mirrorlist http://amazonlinux.ap-south-1.amazonaws.com/2/core /latest/x86_64/mirror.list error was
12: Timeout on http://amazonlinux.ap-south-1.amazonaws.com/2/core/latest/x86_64/ mirror.list: (28, 'Connection timed out after 5000 milliseconds')
One of the configured repositories failed (Unknown),
and yum doesn't have enough cached data to continue. At this point the only
safe thing yum can do is fail. There are a few ways to work "fix" this:
1. Contact the upstream for the repository and get them to fix the problem.
2. Reconfigure the baseurl/etc. for the repository, to point to a working
upstream. This is most often useful if you are using a newer
distribution release than is supported by the repository (and the
packages for the previous distribution release still work).
3. Run the command with the repository temporarily disabled
yum --disablerepo=<repoid> ...
4. Disable the repository permanently, so yum won't use it by default. Yum
will then just ignore the repository until you permanently enable it
again or use --enablerepo for temporary usage:
yum-config-manager --disable <repoid>
or
subscription-manager repos --disable=<repoid>
5. Configure the failing repository to be skipped, if it is unavailable.
Note that yum will try to contact the repo. when it runs most commands,
so will have to try and fail each time (and thus. yum will be be much
slower). If it is a very temporary problem though, this is often a nice
compromise:
yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true
Cannot find a valid baseurl for repo: amzn2-core/2/x86_64
Any help would be much appreciated.

Answer 1

Your instance does not have access to internet.
You can resolve this in following ways:
If your instance is running in a public subnet make sure it has a public ip attached. Also check if the route table for the public subnet is associated with this subnet and has a route 0.0.0.0/0 pointing to internet gateway.
If you are running your instance in private make sure you have created the NAT Gateway in a public subnet. Check the route table has a route 0.0.0.0/0 pointing to NAT and the subnet is associated with the private route table.
Check if the security group associated with instance has outbound traffic enabled.

Answer 2

You are probably in a private subnet (ie a subnet without a 0.0.0.0/0 route to the outside world).
If you want to connect to the outside world, you need a NAT gatway in a public subnet, which has a route to an Internet Gateway.
EC2 -> NAT -> IGW
This is the best AWS troubleshooting page I've found (early 2021)
If you don't want to connect to the outside world, you need a VPC endpoint which allows connectivity to specific AWS services from a private subnet. I have never got this to work.

Answer 3

Verify that the security group attached to the instance is allowing all inbound and outbound connections.
I don't know what specific network protocol is needed for these updates, but public SSH, HTTP, and HTTPS weren't enough for me. So I simply allowed all traffic for a brief time to run the updates.
(I'm guessing it might have simply needed an FTP port open, but I didn't experiment long enough to find out. Feel free to edit this answer if you know specifically which ports are needed for yum updates on EC2 instances.)

Answer 4

If you have an S3 endpoint on your subnet route table then this will cause yum to fail. To fix this please try to add the following policy to the S3 endpoint:
{
"Statement": [
{
"Sid": "Amazon Linux AMI Repository Access",
"Principal": "*",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::packages.*.amazonaws.com/*",
"arn:aws:s3:::repo.*.amazonaws.com/*"
]
}
]
}