hashicorp / hashicorp/packer-plugin-amazon
EBS Builder - Allow additional region_kms_key_ids specified but not used
- Dominant language
- Go
- Stars
- 91
- Forks
- 141
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 3
Description
_This issue was originally opened by @atheiman as hashicorp/packer#10371. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._
Im trying to use the same packer template to build an AMI in multiple regions in the AWS commercial (us-east-1, us-west-1) and govcloud (us-gov-east-1, us-gov-west-1) partitions.
I have a variable for the regions to build in (commercial: `"us-east-1,us-west-1"` govcloud: `"us-gov-east-1,us-gov-west-1"`) that works fine for the `ami_regions` config key. However, when I want to copy the AMI with encryption I need to set the `region_kms_key_ids` config key to an object:
```javascript
// commercial
"region_kms_key_ids": {
"us-east-1": "alias/my-key",
"us-west-1": "alias/my-key"
}
// govcloud
"region_kms_key_ids": {
"us-gov-east-1": "alias/my-key",
"us-gov-west-1": "alias/my-key"
}
```
Looks like object variables (`{"a": "A", "b": "B"}`) are not possible in Packer - maybe this will change with the HCL support thats in progress?
My next thought was to declare all the regions (commercial and govcloud) in `regions_kms_key_ids` and whatever in `ami_regions` is the only regions that will be looked up from the object:
```javascript
"region_kms_key_ids": {
"us-east-1": "alias/my-key",
"us-west-1": "alias/my-key",
"us-gov-east-1": "alias/my-key",
"us-gov-west-1": "alias/my-key"
}
```
This doesnt seem to work, if additional regional kms key ids are declared in `region_kms_key_ids` but not consumed in `ami_regions`, packer fails a validation check:
https://github.com/hashicorp/packer/blob/e89db37717b8a7696d636d88e0adc1f5c8311aed/builder/amazon/common/ami_config.go#L174-L182
I'm guessing there is a reason for this validation check, but its not apparent to me right now. I'd like to be able to specify additional regional kms key ids in `region_kms_key_ids` that are not consumed in `ami_regions` to simplify my template.
My workaround right now is processing the template through `jq` before running `packer build ...` in order to set the `region_kms_key_ids` with either the govcloud or commercial regional kms key ids. Another possible workaround would be to use variables in the keys of the "region_kms_key_ids" config key, but it looks like packer does not allow variables in config keys, only in config values.
If HCL packer will allow object variables, then I suppose this could be closed and the feature will effectively be implemented that way.
Contributor guide
Assessment
This issue has not been assessed yet.