> Source: [sk180606](https://support.checkpoint.com/results/sk/sk180606) # sk180606 - CloudGuard Network for AWS provisioning/deployment fails because of incompatibility with the template user data script | Property | Value | |----------|-------| | Solution ID | sk180606 | | Date Created | 2023-02-06 | | Last Modified | 2026-04-20 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10, R81.10 (EOS), R81.20, R82 | | OS | Gaia | | Platform | AWS | ## Symptoms - * You see in AWS Console that stack deployment fails with the error: ` CREATE_FAILED: AWS::CloudFormation::WaitCondition: "The following resource(s) failed to create..."` * CME log (at */var/log/CPcme/cme.log* ) shows the error: `"ERROR Failed to initialize SIC with the gateway instance... ... (sic-state= uninitialized). Make sure the One-Time Password configured in CME is correct."` * You can find this CME log in SmartConsole: `"Failed to initialize SIC with the gateway instance... ... (sic-state= uninitialized). Make sure the One-Time Password configured in CME is correct."` * This errors are found in the */var/log/aws-user-date.log* file: ` CLINFR0771 Config lock is owned by admin. Use the command 'lock database override' to acquire the lock.` ` CLINFR0519 Configuration lock present. Can not execute this command. To acquire the lock use the command 'lock database override'.` * CME log (at */var/log/CPcme/cme.log* ) shows the error: `"ERROR Failed to initialize SIC with the gateway instance... ... (sic-state= initialized). Make sure the One-Time Password configured in CME is correct."` ## Cause The user-data script invoked by the deployment template fails to complete because of a Database lock. **Affected scope** Deployments made with Cloudformation / Terraform template version 20221027 and lower. **Non-Affected scope** Deployments made with Cloudformation / Terraform template version 20221123 and higher are not affected by this issue. **Note:** See [sk116585](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116585&partition=Basic&product=CloudGuard)for detailed instructions on how to find the template version of the deployed CloudGuard Network Security Gateway. ## Solution Solution steps for Single Gateway, Cluster, Management, Multi-Domain Server \& Standalone ----------------------------------------------------------------------------------------- Re-deploy the solution with a newer template version from [sk111013](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111013). Solution for Autoscaling \& Gateway Loadbalancer Autoscaling ------------------------------------------------------------ **Launch Template instructions:** 1. Open the Amazon EC2 console at . 2. From the main menu bar, select **Launch Templates** and select the launch template of the Auto Scaling Group. 3. Click **Actions** \> **Modify template** (Create new version). 4. On the **New Launch Template version,** navigate to **Advanced details** : ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk180606/Userdata202403040909241.jpg) Replace the script in **User Data** with this script:
* **For Gateway LoadBalancer with Autoscaling deployments made with Terraform:** Use the script from the [CloudGuard Network for AWS Gateway Load Balancer Auto Scaling Group Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/Additional-Information.htm?tocpath=Additional%20Information%7C_____0#TerraformTemplate) according to your product version. * **For Autoscaling group deployments made with Terraform:** Show / Hide this Section --------------------START COPYING HERE-------------------------- #cloud-config runcmd: - \| python3 /etc/cloud_config.py enableCloudWatch=\\"PUT HERE true OR false\\" sicKey=\\"BASE64-ENCODED ONE-TIME PASSWORD\\" installationType=\\"autoscale\\" osVersion=\\"CHECK POINT VERSION: R81.10/R81.20/R82/R82.10\\" allowUploadDownload=\\"PUT HERE true OR false\\" templateVersion=\\"20221226\\" templateName=\\"autoscale\\" templateType=\\"terraform\\" shell=\\"PUT HERE /etc/cli.sh OR /bin/bash OR /bin/csh OR /bin/tcsh\\" enableInstanceConnect=\\"PUT HERE true OR false\\" passwordHash=\\"PUT HERE BASE64-ENCODED PASSWORD HASH OR KEEP IT EMPTY\\" bootstrapScript64=\\"\\"
--------------------STOP COPYING HERE-------------------------- * **For Gateway LoadBalancer with Autoscaling deployments made with CloudFormation:** Use the script from the [CloudGuard Network for AWS Gateway Load Balancer Auto Scaling Group Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/Additional-Information.htm?tocpath=Additional%20Information%7C_____0#CFTemplate) according to your product version. * **For Autoscaling deployments made with CloudFormation:** Show / Hide this Section --------------------START COPYING HERE-------------------------- #cloud-config runcmd: - \| set -e admin_shell=PUT HERE /etc/cli.sh OR /bin/bash OR /bin/csh OR /bin/tcsh ; allow_info=PUT HERE true OR false ; cw=PUT HERE true OR false ; eic=PUT HERE true OR false sic="$(echo BASE64-ENCODED ONE-TIME PASSWORD)" pwd_hash="$(echo PUT HERE BASE64-ENCODED PASSWORD HASH OR KEEP IT EMPTY)" maintenance_pwd_hash="$(echo PUT HERE BASE64-ENCODED MAINTENANCE PASSWORD HASH (using grub2-mkpasswd-pbkdf2) OR KEEP IT EMPTY)" bootstrap="$(echo )" version=CHECK POINT VERSION: R81.10/R81.20/R82/R82.10 python3 /etc/cloud_config.py enableCloudWatch=\\"${cw}\\" sicKey=\\"${sic}\\" installationType=\\"autoscale\\" osVersion=\\"${version}\\" allowUploadDownload=\\"${allow_info}\\" templateVersion=\\"20230129\\" templateName=\\"autoscale\\" shell=\\"${admin_shell}\\" enableInstanceConnect=\\"${eic}\\" passwordHash=\\"${pwd_hash}\\" MaintenanceModePassword=\\"${maintenance_pwd_hash}\\" bootstrapScript64=\\"${bootstrap}\\" --------------------STOP COPYING HERE--------------------------
5. In the newly placed script, make sure to edit these fields: 1. *allow_info* (Allow sending usage data to Check Point) 2. *cw* (AWS CloudWatch) 3. *eic* (Elastic Instance Connect) 4. *sic* (base64 encoded sic one-time password) 5. *pwd_hash* (base64 encoded admin password) 6. *maintenance_pwd_hash*(base64 encoded maintenance password) 7. *version* (Check Point Gateway version) 6. Select **Create template version**. 7. On the navigation pane below **Auto Scaling** , select **Auto Scaling Groups** . Select the checkbox next to the Auto Scaling group. A divided pane opens at the bottom section of the page, showing information about the selected group. 8. On the **Details** tab, select **Launch Template** and**Edit**. 9. For Launch Template, select the **new Version**. 10. When you have finished, select **Update**. 11. Deploy a new Autoscale instance (scale-out) and make sure that the instance provision completes successfully. **Launch Configuration instructions:** 1. Open the Amazon EC2 console at . 2. On the navigation pane below **Auto Scaling** , select **Launch Configurations**. 3. Select **Actions** \>**Copy launch configuration**. 4. This creates a new launch configuration with the same options as the initial but with "Copy" added to the name. 5. On the **Copy Launch Configuration** page, below **Advanced details** : ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk180606/AWS launch configuration202302070845171.png) Replace the script in **User Data** with this script:
* **For Gateway LoadBalancer with Autoscaling deployments made with Terraform:** Use the script from the [CloudGuard Network for AWS Gateway Load Balancer Auto Scaling Group Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/Additional-Information.htm?tocpath=Additional%20Information%7C_____0#LaunchTerraformTemplate) according to your product version. * **For Autoscaling group deployments made with Terraform:** Show / Hide this Section --------------------START COPYING HERE-------------------------- #cloud-config runcmd: - \| python3 /etc/cloud_config.py enableCloudWatch=\\"PUT HERE true OR false\\" sicKey=\\"BASE64-ENCODED ONE-TIME PASSWORD\\" installationType=\\"autoscale\\" osVersion=\\"CHECK POINT VERSION: R81.10/R81.20/R82/R82.10\\" allowUploadDownload=\\"PUT HERE true OR false\\" templateVersion=\\"20221226\\" templateName=\\"autoscale\\" templateType=\\"terraform\\" shell=\\"PUT HERE /etc/cli.sh OR /bin/bash OR /bin/csh OR /bin/tcsh\\" enableInstanceConnect=\\"PUT HERE true OR false\\" passwordHash=\\"PUT HERE BASE64-ENCODED PASSWORD HASH OR KEEP IT EMPTY\\" bootstrapScript64=\\"\\"
--------------------STOP COPYING HERE-------------------------- * **For Gateway LoadBalancer with Autoscaling deployments made with CloudFormation:** Use the script from the [CloudGuard Network for AWS Gateway Load Balancer Auto Scaling Group Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/Additional-Information.htm?tocpath=Additional%20Information%7C_____0#LaunchCFTemplate) according to your product version. * **For Autoscaling deployments made with CloudFormation:** Show / Hide this Section --------------------START COPYING HERE-------------------------- #cloud-config runcmd: - \| set -e admin_shell=PUT HERE /etc/cli.sh OR /bin/bash OR /bin/csh OR /bin/tcsh ; allow_info=PUT HERE true OR false ; cw=PUT HERE true OR false ; eic=PUT HERE true OR false sic="$(echo BASE64-ENCODED ONE-TIME PASSWORD)" pwd_hash="$(echo PUT HERE BASE64-ENCODED PASSWORD HASH OR KEEP IT EMPTY)" maintenance_pwd_hash="$(echo PUT HERE BASE64-ENCODED MAINTENANCE PASSWORD HASH (using grub2-mkpasswd-pbkdf2) OR KEEP IT EMPTY)" bootstrap="$(echo )" version=PUT HERE CHECK POINT VERSION: R81.10/R81.20/R82/R82.10 python3 /etc/cloud_config.py enableCloudWatch=\\"${cw}\\" sicKey=\\"${sic}\\" installationType=\\"autoscale\\" osVersion=\\"${version}\\" allowUploadDownload=\\"${allow_info}\\" templateVersion=\\"20230129\\" templateName=\\"autoscale\\" shell=\\"${admin_shell}\\" enableInstanceConnect=\\"${eic}\\" passwordHash=\\"${pwd_hash}\\" MaintenanceModePassword=\\"${maintenance_pwd_hash}\\" bootstrapScript64=\\"${bootstrap}\\" --------------------STOP COPYING HERE--------------------------
6. In the newly placed script, make sure to edit these fields: 1. *allow_info* (Allow sending usage data to Check Point) 2. *cw* (AWS CloudWatch) 3. *eic* (Elastic Instance Connect) 4. *sic* (base64 encoded sic one-time password) 5. *pwd_hash* (base64 encoded admin password) 6. *version* (Check Point Gateway version) 7. Select **Create launch configuration**. 8. On the navigation pane below **Auto Scaling** , select **Auto Scaling Groups** . Select the checkbox next to the Auto Scaling group. A divided pane opens at the bottom section of the page, showing information about the selected group. 9. On the **Details** tab, select **Launch configuration** and**Edit**. 10. For Launch configuration, select the **new launch configuration**. 11. When you have finished, select **Update**. 12. Deploy a new Autoscale instance (scale-out) and make sure that the instance provision completes successfully. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content