hashicorp / hashicorp/packer-plugin-amazon
'temporary_iam_instance_profile_policy_document' option does not seem to work in AWS china
- Dominant language
- Go
- Stars
- 91
- Forks
- 141
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 3
Description
_This issue was originally opened by @yogeek as hashicorp/packer#10026. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._
#### Overview of the Issue
Because of hashicorp/packer#10024, I tried to use the `temporary_iam_instance_profile_policy_document` as a workaround (as documented [here](https://www.packer.io/docs/builders/amazon-ebs#temporary_iam_instance_profile_policy_document) but this option does not seem to work in AWS China.
May it be because AWS China IAM API is not located at the same URLs ? (`.amazonaws.com.cn` instead of `.amazonaws.com`)
Error :
```
Build 'amazon-ebs' errored after 22 seconds 398 milliseconds: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ec2.amazonaws.com"
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
```
#### Reproduction Steps
Try to build an AWS AMI with the code provided in the **Simplified Packer Buildfile** section.
### Packer version
`Packer v1.6.4`
### Simplified Packer Buildfile
```
{
"min_packer_version": "1.3.0",
"variables": {
"aws_region": "{{ env `AWS_DEFAULT_REGION` }}",
"aws_profile": "{{ env `AWS_PROFILE` }}",
[...]
},
"builders": [
{
"type": "amazon-ebs",
"region": "{{user `aws_region`}}",
"instance_type": "t3.micro",
"associate_public_ip_address": true,
"ssh_interface" : "public_ip",
"temporary_iam_instance_profile_policy_document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ecr:*",
"Resource": "*"
}]
},
[...]
```
### Log Fragments and crash.log files
```
==> amazon-ebs: Creating temporary instance profile for this instance: packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
2020/10/01 16:53:58 packer-builder-amazon-ebs plugin: [DEBUG] Waiting for temporary instance profile: packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
2020/10/01 16:53:59 packer-builder-amazon-ebs plugin: [DEBUG] Found instance profile packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
==> amazon-ebs: Creating temporary role for this instance: packer-5f7609a4-e7bd-6985-f9f0-b790f8cad5a5
==> amazon-ebs: status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> amazon-ebs: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ec2.amazonaws.com"
==> amazon-ebs: status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> amazon-ebs: Deleting temporary instance profile...
==> amazon-ebs: Deleting temporary security group...
==> amazon-ebs: Deleting temporary keypair...
2020/10/01 16:54:04 [INFO] (telemetry) ending amazon-ebs
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> Wait completed after 22 seconds 398 milliseconds
2020/10/01 16:54:04 machine readable: error-count []string{"1"}
==> Some builds didn't complete successfully and had errors:
2020/10/01 16:54:04 machine readable: amazon-ebs,error []string{"MalformedPolicyDocument: Invalid principal in policy: \"SERVICE\":\"ec2.amazonaws.com\"\n\tstatus code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747"}
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
==> Builds finished but no artifacts were created.
2020/10/01 16:54:04 [INFO] (telemetry) Finalizing.
Build 'amazon-ebs' errored after 22 seconds 398 milliseconds: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ec2.amazonaws.com"
status code: 400, request id: 920a5812-471a-40f0-b701-3e90770a2747
```
### Resolution attempt
I tried to solve this by specifying the "Principal" pointing to China EC2 endpoint in the policy :
```
"temporary_iam_instance_profile_policy_document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com.cn"
]
},
"Action": "ecr:*",
"Resource": "*"
}]
},
```
but I had this error :
```
packer validate k8s.json
Error: Failed to prepare build: "amazon-ebs"
1 error occurred:
* unknown configuration key:
'"temporary_iam_instance_profile_policy_document.Statement[0].Principal"'
```
Contributor guide
Assessment
This issue has not been assessed yet.