We are automating AMI Builder (EBS backed) deployment and in the same deployment coping the (EBS encrypted) AMI in all regions and sharing same to a different account as well.
We have passed configuration as region_kms_key_ids along with KMS id and passed region list in variables but we are getting
us-west-2 is in region_kms_key_ids but not in ami_regions,
but if we hardcode the region list in ami_regions validate the packer successfully.
We are using the 1.8.2 packer version sharing the packer file along with the variable file
variables.json
{
“_comment”: “AMI creation - non prod env”,
“aws_region”: “us-west-2”,
“vpc_id”: “vpc-”,
“subnet_id”: “subnet-”,
“ami_users”: “797659667320”,
“kms_key_id”: “mrk-cc73535205e445b591a69dda784551e6”,
“destination_regions”: “us-west-2,us-east-2”,
“source_ami_id”: “ami-0b36cd6786bcfe120”,
“source_ami_owners”: “137112412989”,
“source_ami_filter_name”: “amzn2-ami-kernel-5.10-hvm-2.*”,
“launch_block_device_mappings_volume_size”: “20”,
“launch_ami_block_device_mappings_volume_size”: “20”
}
packerfile
{
“variables”: {
“aws_region”: “”,
“ami_name”: null,
“creator”: “{{env USER}}”,
“encrypted”: “true”,
“kms_key_id”: “”,
“aws_access_key_id”: “{{env AWS_ACCESS_KEY_ID}}”,
“aws_secret_access_key”: “{{env AWS_SECRET_ACCESS_KEY}}”,
“aws_session_token”: “{{env AWS_SESSION_TOKEN}}”,
“source_ami_id”: “”,
“source_ami_owners”: “”,
“source_ami_filter_name”: “”,
“arch”: null,
“instance_type”: null,
“ssh_username”: “ec2-user”,
“ssh_interface”: “”,
“ami_description”: “Vulnerability Scanning AMI with AmazonLinux2 image”,
“temporary_security_group_source_cidrs”: “”,
“security_group_id”: “”,
“associate_public_ip_address”: “”,
“vpc_id”:“”,
“subnet_id”: “”,
“remote_folder”: “”,
“launch_block_device_mappings_volume_size”: “”,
“launch_ami_block_device_mappings_volume_size”: “”,
“ami_users”: “”,
“destination_regions”: “”
},
“builders”: [
{
“type”: “amazon-ebs”,
“region”: “{{user aws_region}}”,
“source_ami”: “{{user source_ami_id}}”,
“ami_users”: “{{user ami_users}}”,
“snapshot_users”: “{{user ami_users}}”,
“source_ami_filter”: {
“filters”: {
“name”: “{{user source_ami_filter_name}}”,
“architecture”: “{{user arch}}”,
“root-device-type”: “ebs”,
“state”: “available”,
“virtualization-type”: “hvm”
},
“owners”: [
“{{user source_ami_owners}}”
],
“most_recent”: true
},
“instance_type”: “{{user instance_type}}”,
“launch_block_device_mappings”: [
{
“device_name”: “/dev/xvda”,
“volume_type”: “gp2”,
“encrypted”: true,
“kms_key_id”: “{{user kms_key_id}}”,
“volume_size”: “{{user launch_block_device_mappings_volume_size}}”,
“delete_on_termination”: true
}
],
“ami_block_device_mappings”: [
{
“device_name”: “/dev/xvda”,
“volume_type”: “gp2”,
“volume_size”: “{{user launch_ami_block_device_mappings_volume_size}}”,
“delete_on_termination”: true
}
],
“ssh_username”: “{{user ssh_username}}”,
“ssh_interface”: “{{user ssh_interface}}”,
“ami_regions”: “us-west-2,us-east-2”,
“ssh_pty”: true,
“temporary_security_group_source_cidrs”: “{{user temporary_security_group_source_cidrs}}”,
“security_group_id”: “{{user security_group_id}}”,
“user_data_file”: “./scripts/user_data.sh”,
“associate_public_ip_address”: “{{user associate_public_ip_address}}”,
“encrypt_boot”: “{{user encrypted}}”,
“region_kms_key_ids”: {
“us-east-2”: “{{user kms_key_id}}”,
“us-west-2”: “{{user kms_key_id}}”
},
“run_tags”: {
“creator”: “{{user creator}}”
},
“subnet_id”: “{{user subnet_id}}”,
“tags”: {
“Name”: “{{user ami_name}}”,
“created”: “{{timestamp}}”,
“source_ami_id”: “{{ user source_ami_id}}”
},
“ami_name”: “{{user ami_name}}”,
“ami_description”: “{{ user ami_description }}”
}
],
“provisioners”: [
{
“type”: “shell”,
“remote_folder”: “{{ user remote_folder}}”,
“expect_disconnect”: true,
“script”: “{{template_dir}}/scripts/CIS_Amazon_Linux2_Benchmark_v1_0_0_Remediation.sh”,
“execute_command”:“echo ‘packer’ | {{.Vars}} sudo -S -E bash -eux ‘{{.Path}}’”
}
],
“post-processors”: [
{
“type”: “manifest”,
“output”: “manifest.json”,
“strip_path”: true
}
]
}