Question: Why am I receiving errors when using yum on my EC2 instance running Amazon Linux 1 or Amazon Linux 2?

Why am I receiving errors when using yum on my Amazon Elastic Compute Cloud (Amazon EC2) instance running Amazon Linux 1 or Amazon Linux 2?Short descriptionUse the output messages of the yum command to determine what error occurred. The following are common error messages:Connection timed out XXX millisecondsHTTP Error 403 - ForbiddenCould not resolve host: xxxxxxxxx.$awsregion.$awsdomainHTTP Error 407 - Proxy Authentication RequiredResolving timed out after 5000 milliseconds

ResolutionConnection timed out XXXX milliseconds1.    Verify that the security group attached to your EC2 instance allows outbound http/https traffic.2.    Verify that the network ACLs associated with your EC2 instance's subnet allows outbound http/https traffic through your NACLs.The following example shows a custom network ACL that allows outbound traffic on port 80 and 443:Inbound rulesRule#    Type                    Protocol    Port Range    Source        Allow/Deny100      Custom TCP Rule         TCP (6)     1024-65535    0.0.0.0/0     ALLOW101      Custom TCP Rule         TCP (6)     1024-65535    ::/0          ALLOW*        ALL Traffic             ALL         ALL           ::/0          DENY*        ALL Traffic             ALL         ALL           0.0.0.0/0     DENYOutbound rulesRule #    Type                   Protocol    Port Range    Source       Allow/Deny100       HTTP (80)              TCP (6)     80            0.0.0.0/0    ALLOW101       HTTPS (443)            TCP (6)     443           0.0.0.0/0    ALLOW102       HTTP (80)              TCP (6)     80            ::/0         ALLOW103       HTTPS (443)            TCP (6)     443           ::/0         ALLOW*         ALL Traffic            ALL         ALL           ::/0         DENY*         ALL Traffic            ALL         ALL           0.0.0.0/0    DENY3.    Verify that your EC2 instance has access to Amazon Linux repositories using one of the following optionsYour instance is in a public subnet with an internet gateway. For more information, see Turn on internet access.Your instance is in a private subnet with a NAT gateway. For more information, see NAT gateways.Your instance is in a private subnet with a NAT instance. For more information, see NAT instances.Your instance is in a public or private subnet with an Amazon Simple Storage Service (Amazon S3) VPC endpoint. For more information, see How can I update yum or install packages without internet access on EC2 instances running Amazon Linux 1 or Amazon Linux 2?Your instance is in a private subnet with a proxy. To configure yum to use a proxy, modify the /etc/yum.conf file with the following parameters. In the following example, replace proxy-port, proxy-user-name, and proxy-password with the correct values for your proxy.proxy=http://proxy-server-IP-address:proxy_portproxy_username="proxy-user-name"proxy_password="proxy-password"For more information, see Using yum with a proxy server on the fedoraproject.org website.4.    After configuring your instance using one of the preceding options, run the following curl command to confirm that the instance can access the repository. In the following command, replace us-east-1 with your instance's Region.Amazon Linux 1curl -I repo.us-east-1.amazonaws.comAmazon Linux 2curl -I amazonlinux.us-east-1.amazonaws.comNote: curl is pre-installed on all AMIs, but the Amazon Linux repositories aren't accessible without credentials. curl can't take the credentials of a yum repository. You receive an access denied error message similar to the one below. The curl command is used to test whether the timeout issue is still occurring. The error message shows that the network is reachable and the timeout issue is no longer occurring:$ curl -I amazonlinux.us-east-1.amazonaws.comHTTP/1.1 403 Forbiddenx-amz-bucket-region: us-east-1x-amz-request-id: xxxxxxxxx-amz-id-2: xxxxxxxxxxxxx=Content-Type: application/xmlDate: Thu, 17 Nov 2022 16:59:59 GMTServer: AmazonS3To install software, such as telnet, run the following command:sudo yum install telnetHTTP Error 403 - Forbidden1.    If you use an Amazon S3 VPC endpoint in your instance's VPC, verify that the attached policy allows the s3:GetObject API call on the following resources:Amazon Linux 1:"arn:aws:s3:::packages.region.amazonaws.com/*""arn:aws:s3:::repo.region.amazonaws.com/*"Amazon Linux 2:"arn:aws:s3:::amazonlinux.region.amazonaws.com/*""arn:aws:s3:::amazonlinux-2-repos-region/*"Note: Replace the Region in the preceding examples with your instance's Region.For more information, see Endpoint policies for Amazon S3.2.    If you use a proxy to access Amazon Linux repositories, verify that the subdomains .amazonaws.com are on the allow list in your proxy configuration.Could not resolve host: xxxxxxxx.$awsregion.$awsdomain1.    Run the following commands to verify that the directory  /etc/yum/vars defines the custom yum variables. The directory must include the variables awsdomain and awsregion. In the following example command, replace us-east-1 with your instance's Region.$ cat /etc/yum/vars/awsregionus-east-1$ cat /etc/yum/vars/awsdomainamazonaws.com2.    Verify the DNS resolution of your instance. The instance must resolve the domain name of the Amazon Linux repositories:$ dig amazonlinux.us-east-1.amazonaws.com$ dig repo.us-east-1.amazonaws.comQueries to the Amazon provided DNS server at the 169.254.169.253 IPv4 address and the fd00:ec2::253 IPv6 address will succeed. Queries to the Amazon provided DNS server at the reserved IP address at the base of the VPC IPv4 network range plus two will also succeed. The IPv6 address is accessible only on EC2 instances built on the Nitro System.HTTP Error 407 - Proxy Authentication RequiredThis occurs if your proxy can't complete the request because yum doesn't have proper authentication credentials for your proxy server. To configure yum to use a proxy, modify the /etc/yum.conf file with the following parameters:proxy=http://proxy-server-IP-address:proxy_portproxy_username=proxy-user-nameproxy_password=proxy-passwordResolving timed out after 5000 millisecondsRun the following command to verify that the /etc/resolv.conf file has the correct IP for your DNS server:cat /etc/resolv.confnameserver YourDNSIPYou can modify the time-out period of 5000 milliseconds by modifying the timeout value in the  yum configuration file.To check the query time using dig, run the following command:$ dig repo.us-east-1.amazonaws.com | grep time