Question: How do I troubleshoot AWS Replication Agent installation failure on my EC2 Linux instance?

I'm installing the AWS Replication Agent for AWS Application Migration Service or AWS Elastic Disaster Recovery. The installation failed on my Amazon Elastic Compute Cloud (Amazon EC2) Linux instance.

ResolutionIdentify the errorThe AWS Replication Agent installer log shows errors starting at the end of the log. Run the following command to view the last page of the installer log to determine the error. Then, review the following section that pertains to the error.less +G aws_replication_installer.logThe following resolution covers the most common AWS Replication Agent installation errors on Linux operating systems.libz.so .1: failed to map segment from shared object: Operation not permittedError example./aws-replication-installer-64bit: error while loading shared libraries: libz.so .1: failed to map segment from shared object: Operation not permittedThe installation script uses the /tmp directory. If noexec is set on /tmp, then libz.so can't map segments. When this occurs, you receive this operation not permitted error.To resolve this error, do the following:1.    Run the following command to unmount /tmp:# umount /tmp2.    Run the following command to mount the volume with exec permission:# sudo mount /tmp -o remount, execThe security token included in the request is expiredError examplebotocore.exceptions.ClientError: An error occurred (ExpiredTokenException) when calling the GetAgentInstallationAssetsForDrs operation: The security token included in the request is expired [installation_id: 1a9af9d3-9485-4e02-965e-611929428c61, agent_version: 3.7.0, mac_addresses: 206915885515739,206915885515740, _origin_client_type: installer]This error is often caused by an expired AWS Identify and Access Management (IAM) role. When the IAM role expires, API calls to the Application Migration Service or Elastic Disaster Recovery endpoint fail.To resolve this issue, refresh the IAM role, or install the role with an access key or secret access key. For more information, see:Application Migration Service: Generating the required AWS credentialsElastic Disaster Recovery: Generating the required AWS credentialsrmmod: ERROR: Module aws_replication_driver is not currently loadedError examplermmod: ERROR: Module aws_replication_driver is not currently loaded insmod: ERROR: could not insert module ./aws-replication-driver.ko: Required key not availableThis error occurs when secure boot is turned on in the source instance. Secure boot isn't supported by Application Migration Service or Elastic Disaster Recovery.To resolve this error, turn off secure boot in the source instance.ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]Error examplessl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997) - urllib.error.URLError: <urlopen error unknown url type: https>Note: In addition to this error, you can resolve most urllib/SSL errors using the following method.This error might occur if the client is using an older OS version with Python 3.10 or newer. Python 3.10 added the PEP 644 – Require OpenSSL 1.1.1 or newer proposal.Older OS versions don't have the newest OpenSSL library that supports Python 3.10. So the AWS Replication Agent installation fails to verify the SSL certificate to the Application Migration Service or Elastic Disaster Recovery endpoint.To avoid this error, use an older version of Python, such as version 2.7 or 3.8.botocore.exceptions.CredentialRetrievalErrorError example:botocore.exceptions.CredentialRetrievalError: Error when retrieving credentials from cert: Oct 17, 2022 9:38:54 AM com.amazonaws.cloudendure.credentials_provider.SharedMain createAndSaveJksThis error might occur if you modify the AWS Replication Agent role, AWSElasticDisasterRecoveryAgentRole/ AWSApplicationMigrationAgentRole.To resolve this error, make sure that the AWS Replication Agent role is as follows:Application Migration Service{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "PrincipalGroup": {        "AWS": "svc:mgn.amazonaws.com"      },      "Action": [        "sts:AssumeRole",        "sts:SetSourceIdentity"      ],      "Condition": {        "StringLike": {          "sts:SourceIdentity": "s-*",          "aws:SourceAccount": "AWSACCOUNTIDHERE"        }      }    }  ]}Elastic Disaster Recovery{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "PrincipalGroup": {        "AWS": "svc:drs.amazonaws.com"      },      "Action": [        "sts:AssumeRole",        "sts:SetSourceIdentity"      ],      "Condition": {        "StringLike": {          "aws:SourceAccount": "AWSACCOUNTIDHERE",          "sts:SourceIdentity": "s-*"        }      }    }  ]}stderr: A dependency job for aws-replication.target failed.Error example:stderr: A dependency job for aws-replication.target failed. See 'journalctl -xe' for detailsThe following are the two possible causes for this error:The /var directory has permissions of 754.There was an issue creating a Linux group for the aws-replication user.To resolve the /var issue, run chmod 755 for the /var directory.To resolve the Linux group issue, do the following:1.    Fully uninstall AWS Replication Agent.2.    Run the following commands to delete the aws-replication user and aws-replication group:# userdel aws-replication # groupdel aws-replication3.    Reinstall AWS Replication Agent.For more information and installation prerequisites, see:Application Migration Service: Supported operating systemsElastic Disaster Recovery: Supported operating systemsException in thread "main" com.amazonaws.services.drs.model.InternalServerExceptionError example:Exception in thread "main" com.amazonaws.services.drs.model.InternalServerException: An unexpected error has occurred (Service: Drs; Status Code: 500; Error Code: InternalServerException; Request ID: 4f4a76cb-aaec-44cc-a07a-c3579454ca55; Proxy: null)This error occurs if the client turns off the AWS STS endpoint. If the AWS STS endpoint is turned off, then Application Migration Service can't call STS to assume the role in the client account. The same is true for Elastic Disaster Recovery.To resolve this error, turn on the AWS STS endpoint in the client. For more information, see Activating and deactivating AWS STS in an AWS Region.insmod: ERROR: could not insert module ./aws-replication-driver.ko: Required key not availableThis error occurs if the operating system has secure boot turned on. Application Migration Service and Elastic Disaster Recovery don't support Linux operating systems with secure boot turned on.To resolve this error, turn off secure boot for the Linux operating system. On most operating systems, turn off secure boot in the hypervisor.insmod: ERROR: could not insert module ./aws-replication-driver.ko: Cannot allocate memoryError example:insmod: ERROR: could not insert module ./aws-replication-driver.ko: Cannot allocate memoryrmmod: ERROR: Module aws_replication_driver is not currently loaded]2023-03-16 10:27:08,416 ERROR      Exception during agent installation                                             Traceback (most recent call last):  File "cirrus/installer_shared/installer_main.py", line 308, in run_agent_installer_command_linux  File "shared/installer_utils/command_utils.py", line 161, in runshared.installer_utils.command_utils.RunException: command: /tmp/tmp_tThis error occurs if the Linux operating system doesn't have sufficient memory for agent installation.To resolve this error, make sure that your operating system has at least 300 MB of free memory.Unexpected error while making agent driver! Are kernel linux headers installed correctly?Error example:Unexpected error while making agent driver! Are kernel linux headers installed correctly?Installation returned with code 1Installation failed due to unspecified error:During agent installation, the installation downloads a matching kernel-devel package from the package repository configured in your Linux operating system. This error occurs when the agent installation workflow can't install the matching kernel-devel package to the Linux OS's running kernel.To resolve this error, review the installation log to verify that there was an issue accessing the repository. Then, download the kernel-devel package manually from the internet. After downloading the package, run the installation again.You can download the matching kernel-devel/linux-headers package from the following sites:RHEL, CentOS, Oracle, and SUSE package directoryDebian package directory on the debian.org website.Ubuntu package directory on the Ubuntu packages website.The AWS Replication Agent also installs dependencies required for the installation, such as make gcc perl tar gawk rpm. For more information see, Linux installation requirements.