hashicorp / hashicorp/packer-plugin-amazon
Unable to use ami_regions when Tags-on-create policy enforced
- Dominant language
- Go
- Stars
- 91
- Forks
- 141
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 3
Description
#### Overview of the Issue
Our organization enforces an AWS Organizations tag policy (“Tags-on-create” enforcement) that requires some tags at the moment the AMI is created in the destination region.
When Packer uses `ami_regions` to copy an AMI, it seems that tags aren’t supplied as TagSpecifications in that copy request, and the call is rejected before any post-copy tagging can occur — which yields this error:
TagPolicyViolation: The resource is missing the tag key(s) 'RequiredTag'
Therefore, we are unable to use `ami_regions` option.
#### Reproduction Steps
Steps to reproduce this issue
- Introduce “Tags-on-create” enforcement policy in AWS in target region with tag `RequiredTag`
- Add `RequiredTag` tag to `tags` list
- Set `ami_regions` to target region
- AMI copy fails with `TagPolicyViolation: The resource is missing the tag key(s) 'RequiredTag'`
### Plugin and Packer version
packer v1.13.0, plugin v1.3.9
### Simplified Packer Buildfile
```
source "amazon-ebs" "example" {
ami_name = "example"
region = ["eu-central-1"]
ami_regions = ["eu-west-1"]
...
run_tags = {
RequiredTag = "value"
}
snapshot_tags = {
RequiredTag = "value"
}
tags = {
RequiredTag = "value"
}
...
}
build {
sources = ["source.amazon-ebs.sample"]
}
```
### Operating system and Environment details
linux, amd64
Contributor guide
Assessment
This issue has not been assessed yet.