EC2 Scan

Use this scan to discover your EC2 servers and look inside the operating system for installed software, dependencies and performance metrics. Set up AWS access first, then run the scan wizard.

Before you start

Complete the setup in AWS Requirements before running this scan.

You will need:

Running the scan

Launch DMC on the collector host. Click through the welcome screen, select AWS as the scan target, then select EC2 Scan. The wizard then walks through five screens.

DMC welcome screen
DMC welcome screen. Click Next to continue.
DMC scan target selection screen
Select AWS as the scan target.
DMC AWS scan type selection screen
Select EC2 Scan as the scan type.

AWS Configuration

Add an AWS identity so DMC can reach your accounts. Enter a label and the ARN of the collector role, click Add to validate and list the accounts it can reach, then select the regions to include and save the identity.

AWS Configuration screen before adding an identity
AWS Configuration screen. Add an AWS identity to connect DMC to your accounts.
Add AWS Identity form, empty
Enter a label and the ARN of the collector role.
Add AWS Identity form filled with masked credentials
Credentials entered. Click Add to validate and discover accounts.
DMC listing AWS accounts visible to the collector identity
DMC lists the AWS accounts the collector identity can reach.

If only your own account appears here, organizations:ListAccounts may be blocked at the AWS Organizations level rather than by IAM. See AWS Requirements for how to enable multi-account discovery.

AWS Identity form with regions selected
Select the regions to include in the scan.
AWS Configuration screen with identity saved
AWS Configuration screen after the identity is saved.

Guest Credentials

Guest Credentials step of the AWS scan wizard showing the Guest Execution Methods options for Windows and Linux
Guest Credentials step. Enable the connection methods per platform under Guest Execution Methods, then add credentials for the direct methods.

Under Guest Execution Methods, choose the connection methods DMC may use for each platform. SSM needs no credentials here; it runs through the AWS Systems Manager Agent already on the instance, as SYSTEM on Windows or root on Linux. WinRM / PSRP (Windows) and SSH (Linux) connect to the instance directly and need the credentials from Server admin credentials, added with Add Windows and Add Linux on this screen. A platform with no enabled method, or a direct-only method with no matching credentials, is excluded from the scan.

Settings

Settings step of the AWS scan wizard showing output path, max concurrent servers, metric collection, and scan thresholds
Settings step for an EC2 Scan: output path, concurrency, the CloudWatch metric window, and CPU and memory scan thresholds.

Review the scan settings before running:

  • Output Path: the directory where DMC saves scan results and logs.
  • Max Concurrent Servers: how many instances DMC scans in parallel: 5, 10, 15, or 20 (default 10).
  • Metric Collection: the CloudWatch window DMC pulls performance data from. Set Duration in days (default 7) and Granularity: 5, 15, or 30 minutes, 1 hour, 6 hours, or 1 day (default 15 minutes).
  • Scan Thresholds: the CPU and memory usage level (0-95%, default 85% CPU / 75% memory) above which a server is considered too busy and its guest scan is skipped.

Scan

The Scan screen lists the EC2 instances DMC discovered and how many are in scope. Click Run Scan. DMC shows real-time progress in the console output as it works through each instance.

Results

When the scan completes, DMC produces a password-protected ZIP of the collected data. Hand that file to your Dr Migrate contact, or import it into Dr Migrate yourself.

Confirm it worked

Before you finish, check these. They catch the most common issues:

  • The collector host can reach AWS APIs on port 443
  • The collector identity can assume the scan role with no "access denied"
  • Your target instances appear (and show as Managed if using SSM)
  • A test server returns software and network data, not just the EC2 record
  • The export ZIP is created and you have its password

Common issues

Symptom Fix
"AssumeRole denied" Check the scan role trust policy names the correct collector identity ARN.
No regions found Confirm ec2:DescribeRegions is allowed, or select regions manually.
SSM scan fails Confirm the instance is a Managed node and the SSM output bucket permission is attached.
Linux/Windows scan returns little data Use root/sudo (Linux) or a local administrator account (Windows). See Server admin credentials.

← Back to scan choices | AWS Estate Discovery →

© 2025 Altra Technologies
ESC