Ubuntu Pro has become the standard for enterprise-grade features on open source software. It includes Expanded Security Maintenance (ESM), which extends the LTS period from 5 to 10 years for any LTS release and also expands security coverage to the Universe repository, covering thousands of packages that were previously supported on a best-effort basis or left to the community.
Ubuntu Pro also includes Kernel Livepatch, which patches your kernel in memory and avoids unplanned maintenance windows. On top of that, it adds a whole set of compliance features (hardening and FedRAMP compliance) that you can enable with just a few commands.
Ubuntu Pro is available for AMD64 and Graviton platforms, both with an optimized kernel that provides better performance while supporting nearly all available instance types.
Visit https://ubuntu.com/aws/pro to learn more about the Ubuntu Pro features offered across the different Ubuntu versions and architectures.
In this guide, learn the options and best practices to get Ubuntu Pro on AWS.
Ubuntu Pro: offerings and how to get it
Ubuntu Pro is available in different formats and can be acquired in different ways: from pre-enabled AMIs on EC2 and Marketplace, to image customization with EC2 Image Builder, to in-place upgrades through AWS License Manager.
The following table shows all Ubuntu Pro products on AWS and how to get them.
| Product name | Description | Launching new machines | Upgrading my own | Upgrading my custom image |
|---|---|---|---|---|
| Ubuntu Pro | Base Ubuntu Pro, from 20.04 to the latest release. | Launch Marketplace or EC2 (quick launch menu) images | Use License Manager and create a License Conversion (destination can be Pro EC2 or Marketplace) | Using EC2 Image Builder (Marketplace license) or Packer with a base Ubuntu Pro AMI |
| Ubuntu Pro FIPS | An AMI with a FIPS kernel and crypto modules pre-enabled. | Launch from Marketplace | Same as above, then enable FIPS | Using EC2 Image Builder (needs a base Pro AMI) or Packer with a base Ubuntu Pro AMI |
| Ubuntu Pro for EKS | Pro-activated images for EKS worker nodes. Enables running Pro containers. | Launch with eksctl, launch templates or CloudFormation templates. Available as EC2 images and on Marketplace |
Nodes can be upgraded using License Manager, but the recommendation is to launch new Pro nodes to replace the old ones. | Using EC2 Image Builder (needs a base Pro EKS AMI) or Packer with a base Ubuntu Pro EKS AMI |
| Minimal Ubuntu Pro | Minimal footprint of Ubuntu with Pro activated. | Available on Marketplace | Use License Manager and create a License Conversion (destination can be Pro EC2 or Marketplace) | Using EC2 Image Builder (Marketplace license) or Packer with a base Minimal Ubuntu Pro AMI |
| Minimal Ubuntu Pro with CIS hardening | Minimal footprint of Ubuntu with Pro activated and CIS controls pre-configured. | Available on Marketplace | Use License Manager and create a License Conversion (destination can be Pro EC2 or Marketplace), then run hardening using USG | Using EC2 Image Builder (needs a base Pro AMI) and run USG later in the recipe, or Packer with a base Ubuntu Pro AMI |
| Ubuntu Pro with real-time kernel | An Ubuntu Pro server with the real-time kernel pre-enabled. | Available on Marketplace | Use License Manager and create a License Conversion (destination can be Pro EC2 or Marketplace), then enable the real-time kernel with the Pro client | Using EC2 Image Builder (needs a base Pro AMI) and enable real-time later in the recipe, or Packer with a base Ubuntu Pro AMI |
Ubuntu Pro architecture reference and requirements
Whether you are launching an Ubuntu Pro AMI or upgrading an Ubuntu LTS instance, make sure your machine has internet access to Canonical’s Pro endpoints for activating services and accessing content. The diagram below is a reference architecture for deployments on public subnets. When deploying in private subnets, you may need a NAT gateway to grant internet access to the machine.
The network endpoints are:
For Kernel Livepatch:
- api.snapcraft.io:443
- dashboard.snapcraft.io:443
- login.ubuntu.com:443
- *.snapcraftcontent.com:443
For more information, please refer to the official documentation.
EC2 vs Marketplace license (AMI and License Manager)
Both AMIs are the same in terms of functionality, features and pricing model, but they have a few differences worth pointing out.
Pricing mechanism. Both share the same pricing mechanism, based on the size of the infrastructure they run on, which in this case is measured by the number of vCPUs of the machine. The biggest difference lies in how AWS charges: EC2 bills per second, while Marketplace bills per hour of usage. If your workloads are very stable, both are similar.
Cost visibility. EC2 images don’t require a subscription, and the operating system price comes embedded in the infrastructure cost. Marketplace, on the other hand, shows the operating system cost separately as a license, which makes it simpler for companies to manage and attribute software costs.
Private offers. Marketplace is the only option with Private Offers available, so enterprises can request a private offer for their existing deployments without having to modify anything.
Support. Customers planning to get phone and ticket support should lean towards the Marketplace license, since support can be attached through Private Offers on existing deployments. That is not possible on EC2 Pro deployments.
Bonus: how to check your coverage
Now that you are running Ubuntu Pro, you may want to run a status check to see what Canonical covers. There is a command line tool, already included in every Ubuntu Server, that reports the status of your coverage:
pro status
