hashicorp / hashicorp/packer-plugin-amazon

Unable to use ami_regions when Tags-on-create policy enforced

Open
#591 4 comments 4 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

#### Overview of the Issue
Our organization enforces an AWS Organizations tag policy (“Tags-on-create” enforcement) that requires some tags at the moment the AMI is created in the destination region.

When Packer uses `ami_regions` to copy an AMI, it seems that tags aren’t supplied as TagSpecifications in that copy request, and the call is rejected before any post-copy tagging can occur — which yields this error:

TagPolicyViolation: The resource is missing the tag key(s) 'RequiredTag'

Therefore, we are unable to use `ami_regions` option.
#### Reproduction Steps

Steps to reproduce this issue
- Introduce “Tags-on-create” enforcement policy in AWS in target region with tag `RequiredTag`
- Add `RequiredTag` tag to `tags` list
- Set `ami_regions` to target region
- AMI copy fails with `TagPolicyViolation: The resource is missing the tag key(s) 'RequiredTag'`

### Plugin and Packer version
packer v1.13.0, plugin v1.3.9

### Simplified Packer Buildfile
```
source "amazon-ebs" "example" {
ami_name = "example"
region = ["eu-central-1"]
ami_regions = ["eu-west-1"]
...
run_tags = {
RequiredTag = "value"
}
snapshot_tags = {
RequiredTag = "value"
}

tags = {
RequiredTag = "value"
}
...
}

build {
sources = ["source.amazon-ebs.sample"]
}
```

### Operating system and Environment details

linux, amd64

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.