How to wait for user data completion of EC2 launched in Private Subnet?

Question

I am writing a cloud formation template to provision an EC2 instance and I want to wait till the user data is completed.

I tried using cfn signal but it's not working while my EC2 is in the private subnet.

Getting client side timeout error

Answer 1

cfn-signal requires an Internet connection, either directly or via a NAT device or proxy, in order to contact CloudFormation and deliver the signal. The endpoints needed for this feature to work are not inside your VPC. (Some AWS services support VPC Endpoints, but as of this writing, this is not one of them).

Your options:

Attach a NAT Gateway or NAT Instance a public subnet in your VPC and then modify the default route for the private subnet to point to the NAT device. A NAT instance has a lower operating cost, while a NAT Gateway supports higher throughput and built-in redundancy and fault tolerance... but if cost is a consideration, a NAT instance on a t2.nano machine would be more than sufficient for this application.

Or, build an EC2 instance on a subnet that has Internet access, using an HTTP proxy, such as squid, configured to allow your instances to connect outward, passing the --http-proxy argument to cfn-signal, giving the proxy's address formatted as a URL, e.g. --http-proxy http://172.32.1.10:3128. It is also possible to build a cluster of such proxies, but this requires using either a Network Load Balancer (NLB) or an ELB Classic in TCP (not HTTP) mode. Application Load Balancer (ALB) can be used with reverse proxies, but does not support forward proxies, and this is a forward proxy application.