Create a NetScaler VPX AMI from the downloadable image

Last published : Nov 05, 2026
This document explains how to convert the NetScaler VPX image you downloaded from the Citrix downloads page into an Amazon Machine Image (AMI) in your own AWS account. The conversion uses AWS's standard VM Import/Export. Because the image is already prepared for AWS, you don't need to configure it further.
Throughout this document, replace the placeholders:
  • <IMAGE_FILE> – The VMDK file you downloaded (for example, <IMAGE_FILE>.vmdk).
  • <AMI_NAME> – The name you want for the resulting AMI.
  • <REGION> – Your target AWS region.
  • <YOUR_BUCKET> – An S3 bucket in the AWS region.
Related information
NetScaler VPX on AWS

Prerequisites

Complete the following setup once per AWS account before you begin.
You need to ensure that you have:
  • The AWS CLI, installed and configured. Confirm that aws sts get-caller-identity succeeds.
  • An S3 bucket in your target AWS region. The import is region-specific, so the bucket must be in the same region where you create the AMI.
  • The vmimport service role, which AWS VM Import requires. Create this role once per AWS account by running these commands:
aws iam create-role --role-name vmimport --assume-role-policy-document 
'{
    "Version":"2012-10-17",
    "Statement":[
     {"Effect":"Allow","Principal":{"Service":"vmie.amazonaws.com"},
    "Action":"sts:AssumeRole","Condition":{"StringEquals":{"sts:Externalid":"vmimport"}}
     }]
}'

aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document 

'{
    "Version":"2012-10-17",
    "Statement":[
      {"Effect":"Allow","Action":["s3:GetBucketLocation","s3:GetObject","s3:ListBucket","s3:PutObject"],
      "Resource":["arn:aws:s3:::<YOUR_BUCKET>","arn:aws:s3:::<YOUR_BUCKET>/*"]},
      {"Effect":"Allow","Action":["ec2:ModifySnapshotAttribute","ec2:CopySnapshot","ec2:RegisterImage","ec2:Describe*"],
      "Resource":"*"}]
}'

Download and verify the image

Download the image and verify its integrity before you import it:
  1. Download the NetScaler VPX image (<IMAGE_FILE>) from the Citrix downloads page.
  2. Verify its integrity by confirming that the image's SHA256 checksum matches the value listed for it on the downloads page:
    sha256sum <IMAGE_FILE>
    Proceed only if the printed checksum matches the one shown on the downloads page.

Create the AMI

After you verify the image, create the AMI:
  1. Set the variables that the import and registration commands use:
    REGION=<REGION>
    BUCKET=<YOUR_BUCKET>
    IMAGE=<IMAGE_FILE>
    NAME="<AMI_NAME>"
  2. Upload the image to the S3 bucket:
    aws s3 cp "$IMAGE" "s3://$BUCKET/ns-import/$IMAGE"
  3. Start the snapshot import:
    TASK=$(aws ec2 import-snapshot --region "$REGION" \
      --description "$NAME" \
      --disk-container "Format=VMDK,UserBucket={S3Bucket=$BUCKET,S3Key=ns-import/$IMAGE}" \
      --query ImportTaskId --output text)
    echo "import task: $TASK"
  4. Wait for the import to complete, and then capture the resulting snapshot ID. The import can take 10–40 minutes:
    while :; do
      S=$(aws ec2 describe-import-snapshot-tasks --region "$REGION" --import-task-ids "$TASK" \
        --query 'ImportSnapshotTasks[0].SnapshotTaskDetail.Status' --output text)
      P=$(aws ec2 describe-import-snapshot-tasks --region "$REGION" --import-task-ids "$TASK" \
        --query 'ImportSnapshotTasks[0].SnapshotTaskDetail.Progress' --output text)
      echo "status=$S progress=$P%"; [ "$S" = completed ] && break
      [ "$S" = deleted ] && { echo "import failed"; exit 1; }
      sleep 20
    done

    SNAP=$(aws ec2 describe-import-snapshot-tasks --region "$REGION" --import-task-ids "$TASK" \
      --query 'ImportSnapshotTasks[0].SnapshotTaskDetail.SnapshotId' --output text)
    echo "snapshot: $SNAP"
  5. Register the AMI with HVM and ENA support:
    VOL=$(aws ec2 describe-snapshots --region "$REGION" --snapshot-ids "$SNAP" \
      --query 'Snapshots[0].VolumeSize' --output text)
    AMI=$(aws ec2 register-image --region "$REGION" \
      --name "$NAME" --description "$NAME" \
      --architecture x86_64 --root-device-name /dev/sda1 \
      --virtualization-type hvm --ena-support \
      --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=$SNAP,VolumeSize=$VOL,VolumeType=gp3,DeleteOnTermination=true}" \
      --query ImageId --output text)
    echo "AMI: $AMI"
    If the downloads page specifies a different root device for your image, use that value for both --root-device-name and the DeviceName entry in this command.
  6. (Optional) Remove the uploaded image from the S3 bucket:
    aws s3 rm "s3://$BUCKET/ns-import/$IMAGE"
When register-image succeeds, the AMI: value it prints is your new AMI ID. You can launch NetScaler VPX instances from it in that region.

Points to consider

  • Your AWS account owns the resulting AMI and it appears as an imported image. Always verify the image's SHA256 against the downloads page before importing.
  • AMI imports are region-specific, so import the image separately in each AWS region where you need the AMI.
  • Launch the AMI on an instance type that supports Elastic Network Adapter (ENA). All current generation instance types support ENA.