hashicorp / hashicorp/packer-plugin-amazon

'temporary_iam_instance_profile_policy_document' option does not seem to work in AWS china

Open
#50 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

_This issue was originally opened by @yogeek as hashicorp/packer#10026. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._


#### Overview of the Issue

Because of hashicorp/packer#10024, I tried to use the `temporary_iam_instance_profile_policy_document` as a workaround (as documented [here](https://www.packer.io/docs/builders/amazon-ebs#temporary_iam_instance_profile_policy_document) but this option does not seem to work in AWS China.
May it be because AWS China IAM API is not located at the same URLs ? (`.amazonaws.com.cn` instead of `.amazonaws.com`)

Error :
```
Build 'amazon-ebs' errored after 22 seconds 398 milliseconds: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ec2.amazonaws.com"
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
```

#### Reproduction Steps

Try to build an AWS AMI with the code provided in the **Simplified Packer Buildfile** section.

### Packer version

`Packer v1.6.4`

### Simplified Packer Buildfile

```
{
"min_packer_version": "1.3.0",
"variables": {
"aws_region": "{{ env `AWS_DEFAULT_REGION` }}",
"aws_profile": "{{ env `AWS_PROFILE` }}",
[...]
},
"builders": [
{
"type": "amazon-ebs",
"region": "{{user `aws_region`}}",
"instance_type": "t3.micro",
"associate_public_ip_address": true,
"ssh_interface" : "public_ip",
"temporary_iam_instance_profile_policy_document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ecr:*",
"Resource": "*"
}]
},
[...]
```

### Log Fragments and crash.log files

```
==> amazon-ebs: Creating temporary instance profile for this instance: packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
2020/10/01 16:53:58 packer-builder-amazon-ebs plugin: [DEBUG] Waiting for temporary instance profile: packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
2020/10/01 16:53:59 packer-builder-amazon-ebs plugin: [DEBUG] Found instance profile packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
==> amazon-ebs: Creating temporary role for this instance: packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
==> amazon-ebs: status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> amazon-ebs: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ec2.amazonaws.com"
==> amazon-ebs: status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> amazon-ebs: Deleting temporary instance profile...
==> amazon-ebs: Deleting temporary security group...
==> amazon-ebs: Deleting temporary keypair...
2020/10/01 16:54:04 [INFO] (telemetry) ending amazon-ebs
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> Wait completed after 22 seconds 398 milliseconds
2020/10/01 16:54:04 machine readable: error-count []string{"1"}
==> Some builds didn't complete successfully and had errors:
2020/10/01 16:54:04 machine readable: amazon-ebs,error []string{"MalformedPolicyDocument: Invalid principal in policy: \"SERVICE\":\"ec2.amazonaws.com\"\n\tstatus code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747"}
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> Builds finished but no artifacts were created.
2020/10/01 16:54:04 [INFO] (telemetry) Finalizing.
Build 'amazon-ebs' errored after 22 seconds 398 milliseconds: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ec2.amazonaws.com"
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
```

### Resolution attempt

I tried to solve this by specifying the "Principal" pointing to China EC2 endpoint in the policy :

```
"temporary_iam_instance_profile_policy_document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com.cn"
]
},
"Action": "ecr:*",
"Resource": "*"
}]
},
```

but I had this error :

```
packer validate k8s.json
Error: Failed to prepare build: "amazon-ebs"

1 error occurred:
* unknown configuration key:
'"temporary_iam_instance_profile_policy_document.Statement[0].Principal"'
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.