hashicorp / hashicorp/packer-plugin-amazon
Add configuration to enable NitroTPM support when registering an AMI
- Dominant language
- Go
- Stars
- 91
- Forks
- 141
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 3
Description
#### Description
[NitroTPM](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitrotpm.html) support allows an AMI to be used with instances that have a virtual TPM module for securely storing secrets and providing secure boot. According to AWS docs, TPM support must be enabled as an option when the AMI is registered.
#### Use Case(s)
Supporting using TPM on EC2.
#### Potential configuration
```
source "amazon-ebs" "my_ami" {
...
tpm_support = "v2.0"
...
}
```
#### Potential References
* AWS docs about [Registering an AMI with TPM support through the aws CLI](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enable-nitrotpm-support-on-ami.html)
* I'm guessing the change will need to happen when the AMI is registered [here](https://github.com/hashicorp/packer-plugin-amazon/blob/main/builder/chroot/step_register_ami.go). I was looking for a way to set this for the ebs builder, but it looks like that one does not perform the RegisterImage step. I'm not familiar with the intricate details of how building/registering an AMI works, so perhaps it isn't possible to set this when building an AMI from another AMI?
* I believe that the option that will need to be set is `RegisterImageInput.TpmSupport = "v2.0"`
Contributor guide
Assessment
This issue has not been assessed yet.