hashicorp / hashicorp/packer-plugin-amazon

Add configuration to enable NitroTPM support when registering an AMI

Open
#314 9 comments 5 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

#### Description

[NitroTPM](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitrotpm.html) support allows an AMI to be used with instances that have a virtual TPM module for securely storing secrets and providing secure boot. According to AWS docs, TPM support must be enabled as an option when the AMI is registered.

#### Use Case(s)

Supporting using TPM on EC2.

#### Potential configuration

```
source "amazon-ebs" "my_ami" {
...
tpm_support = "v2.0"
...
}
```

#### Potential References

* AWS docs about [Registering an AMI with TPM support through the aws CLI](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enable-nitrotpm-support-on-ami.html)
* I'm guessing the change will need to happen when the AMI is registered [here](https://github.com/hashicorp/packer-plugin-amazon/blob/main/builder/chroot/step_register_ami.go). I was looking for a way to set this for the ebs builder, but it looks like that one does not perform the RegisterImage step. I'm not familiar with the intricate details of how building/registering an AMI works, so perhaps it isn't possible to set this when building an AMI from another AMI?
* I believe that the option that will need to be set is `RegisterImageInput.TpmSupport = "v2.0"`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.