hashicorp / hashicorp/packer-plugin-amazon

EBS Builder - Allow additional region_kms_key_ids specified but not used

Open
#34 0 comments 4 reactions 0 assignees View on GitHub
builder/amazon enhancement stage/thinking
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

_This issue was originally opened by @atheiman as hashicorp/packer#10371. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._


Im trying to use the same packer template to build an AMI in multiple regions in the AWS commercial (us-east-1, us-west-1) and govcloud (us-gov-east-1, us-gov-west-1) partitions.

I have a variable for the regions to build in (commercial: `"us-east-1,us-west-1"` govcloud: `"us-gov-east-1,us-gov-west-1"`) that works fine for the `ami_regions` config key. However, when I want to copy the AMI with encryption I need to set the `region_kms_key_ids` config key to an object:

```javascript
// commercial
"region_kms_key_ids": {
"us-east-1": "alias/my-key",
"us-west-1": "alias/my-key"
}
// govcloud
"region_kms_key_ids": {
"us-gov-east-1": "alias/my-key",
"us-gov-west-1": "alias/my-key"
}
```

Looks like object variables (`{"a": "A", "b": "B"}`) are not possible in Packer - maybe this will change with the HCL support thats in progress?

My next thought was to declare all the regions (commercial and govcloud) in `regions_kms_key_ids` and whatever in `ami_regions` is the only regions that will be looked up from the object:

```javascript
"region_kms_key_ids": {
"us-east-1": "alias/my-key",
"us-west-1": "alias/my-key",
"us-gov-east-1": "alias/my-key",
"us-gov-west-1": "alias/my-key"
}
```

This doesnt seem to work, if additional regional kms key ids are declared in `region_kms_key_ids` but not consumed in `ami_regions`, packer fails a validation check:

https://github.com/hashicorp/packer/blob/e89db37717b8a7696d636d88e0adc1f5c8311aed/builder/amazon/common/ami_config.go#L174-L182

I'm guessing there is a reason for this validation check, but its not apparent to me right now. I'd like to be able to specify additional regional kms key ids in `region_kms_key_ids` that are not consumed in `ami_regions` to simplify my template.

My workaround right now is processing the template through `jq` before running `packer build ...` in order to set the `region_kms_key_ids` with either the govcloud or commercial regional kms key ids. Another possible workaround would be to use variables in the keys of the "region_kms_key_ids" config key, but it looks like packer does not allow variables in config keys, only in config values.

If HCL packer will allow object variables, then I suppose this could be closed and the feature will effectively be implemented that way.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.