Skip to Content
Bash Script GuidesAmazon Linux 2 to Rocky Linux from CIQ

Amazon Linux 2 to Rocky Linux from CIQ

Applies to: Amazon Linux 2 on x86_64 and aarch64 (Graviton), AWS only

Overview

migrate2rlc migrates Amazon Linux 2 instances to Rocky Linux 9.6 LTS from CIQ using a blue/green approach. AL2 is based on the RHEL 7 era (glibc 2.26) and cannot be upgraded in-place to Rocky 9 (glibc 2.34). Instead, the script assesses the AL2 source instance, provisions a Rocky 9.6 LTS target from the AWS Marketplace, enrolls it in CIQ Depot, and generates a migration report. The AL2 source instance is never modified.

Prerequisites

  • CIQ Depot credentials (obtain from https://portal.ciq.com)
  • Root access on the AL2 source instance
  • AWS CLI installed and configured with permissions to:
    • Describe instances, AMIs, subnets, security groups
    • Launch instances (ec2:RunInstances)
    • Create tags
  • Network access to https://depot.ciq.com from both source and target
  • Working DNS resolution
  • EC2 Instance Metadata Service (IMDS) reachable
  • AWS Marketplace subscription for Rocky Linux 9.6 LTS from CIQ

Supported Tiers

AL2 migration supports these tiers only:

  • rlc-pro (RLC Pro with SLA, FIPS, CVE timelines)
  • rlc-96-lts (RLC Pro 9.6 LTS, version-pinned)

RLC Plus is not supported for AL2 migration.

Migration Command

Full migration (assess, provision target, enroll):

sudo bash migrate2rlc.sh -r -t rlc-96-lts -u YOUR_USER -p YOUR_TOKEN

Assessment only (inventory + compatibility report, no provisioning):

sudo bash migrate2rlc.sh -r -a -t rlc-96-lts -u YOUR_USER -p YOUR_TOKEN

What Happens During Migration

  1. Script detects Amazon Linux 2 (ID=amzn, VERSION_ID=2) and routes to the AL2 migration path
  2. Pre-flight checks: AWS CLI, IMDS, disk space, Python 3 availability
  3. System inventory: 16 collectors capture packages, services, network, crypto, Docker, SELinux, Python, databases, web stack, kernel modules, certificates
  4. Compatibility analysis: classifies every finding into REPACKAGE, REBUILD, REDESIGN, or REWRITE tiers based on Rocky 9.6 target versions
  5. If not assess-only: resolves the correct Marketplace AMI for the current region and architecture
  6. Provisions a Rocky 9.6 LTS target instance in the same VPC/subnet with matching (or larger) instance type and security groups
  7. Waits for target to be running and SSH-reachable
  8. Verifies target baseline: SELinux enforcing, cgroups v2, crypto-policies DEFAULT, CIQ kernel, depot repos enabled
  9. Installs depot CLI, logs in, enables the selected tier product on the target
  10. Copies /etc configuration files and TLS certificates to the target
  11. Generates a completion report with source/target comparison, findings summary, and manual next steps for data migration

Migration Tiers Explained

The compatibility analysis classifies each finding into one of four tiers:

  • REPACKAGE: Package available on Rocky 9 via dnf install or EPEL (e.g., nginx, AWS SSM Agent, CloudWatch agent)
  • REBUILD: Requires recompilation from source due to version changes (e.g., custom binaries linked against glibc 2.26, Python 3.8 packages)
  • REDESIGN: Configuration changes needed (e.g., iptables to firewalld, cgroups v1 to v2, SELinux policies, systemd timer conversions)
  • REWRITE: Manual review required (e.g., Python 2.7 scripts, deprecated OpenSSL APIs, custom kernel modules)

Post-Migration Steps

After the script completes, these manual steps remain:

  1. Review the completion report at /var/log/al2-to-rocky9-report.txt
  2. Migrate application data (databases, user data, uploads) per the findings
  3. Install application packages on the target per REPACKAGE recommendations
  4. Rebuild custom binaries per REBUILD recommendations
  5. Apply configuration changes per REDESIGN recommendations
  6. Test the target instance with your application workload
  7. Update DNS or load balancer to point to the target instance
  8. Keep the AL2 source instance as rollback until validation is complete

Troubleshooting

AWS CLI not found

The script checks for the aws command. Install via:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && unzip awscliv2.zip && sudo ./aws/install

IMDS unreachable

The script uses IMDS to detect region and instance metadata. Verify IMDS is enabled:

curl -s http://169.254.169.254/latest/meta-data/

Marketplace subscription required

If provisioning fails with "OptInRequired", subscribe to the Rocky 9.6 LTS AMI at https://aws.amazon.com/marketplace and retry.

Insufficient IAM permissions

The script needs ec2:RunInstances, ec2:DescribeInstances, ec2:DescribeImages, ec2:CreateTags.
Attach an IAM policy with these permissions to the instance role or configure access keys.

Target in wrong subnet

By default, the target launches in the same subnet as the source. Override with environment variable AL2_TARGET_SUBNET_ID.

DISCLAIMER

The migrate2rlc script and playbook are provided "as is" without warranty of any kind, express or implied. Use of these tools is entirely at your own risk. CIQ, Inc. assumes no responsibility or liability for any data loss, system downtime, service disruption, or other damage resulting from the use or misuse of these tools. It is the user's responsibility to ensure adequate backups and testing in a non-production environment before performing any migration on production systems.

CentOS Stream 9 to Rocky Linux from CIQAnsible/Ascender Playbook Guides