hashicorp / hashicorp/packer-plugin-amazon

Allow IamInstanceProfile to be optional when using SSM

Open
#664 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

On my organization's AWS account, I get permission errors when using either IamInstanceProfile or TemporaryIamInstanceProfilePolicyDocument options. However, this account has been configured so that SSM is usable regardless (I believe due to "SSM Quick Start" being configured on the account) - any launched EC2 machine automatically gets added an IAM instance profile that permits SSM.

Unfortunately, there are currently validation checks that require non-empty IamInstanceProfile when SSM is enabled, making packer with SSM unusable for me. I have tested that simply removing the checks makes this work for me:
```
diff --git a/builder/common/run_config.go b/builder/common/run_config.go
index 16dc8cf82860..b13842778a33 100644
--- a/builder/common/run_config.go
+++ b/builder/common/run_config.go
@@ -796,11 +796,6 @@ func (c *RunConfig) Prepare(ctx *interpolate.Context) []error {
msg := fmt.Errorf(`session_manager connectivity is not supported with the "winrm" communicator; please use "ssh"`)
errs = append(errs, msg)
}
-
- if c.IamInstanceProfile == "" && c.TemporaryIamInstanceProfilePolicyDocument == nil {
- msg := fmt.Errorf(`no iam_instance_profile defined; session_manager connectivity requires a valid instance profile with AmazonSSMManagedInstanceCore permissions. Alternatively a temporary_iam_instance_profile_policy_document can be used.`)
- errs = append(errs, msg)
- }
}

if c.Comm.SSHKeyPairName != "" {
@@ -963,8 +958,7 @@ func (c *RunConfig) IsSpotInstance() bool {
}

func (c *RunConfig) SSMAgentEnabled() bool {
- hasIamInstanceProfile := c.IamInstanceProfile != "" || c.TemporaryIamInstanceProfilePolicyDocument != nil
- return c.SSHInterface == "session_manager" && hasIamInstanceProfile
+ return c.SSHInterface == "session_manager"
}

// IsBurstableInstanceType checks if the InstanceType for the config is one
diff --git a/common/run_config.go b/common/run_config.go
index d35eb3538c84..732c2823cf4b 100644
--- a/common/run_config.go
+++ b/common/run_config.go
@@ -793,11 +793,6 @@ func (c *RunConfig) Prepare(ctx *interpolate.Context) []error {
msg := fmt.Errorf(`session_manager connectivity is not supported with the "winrm" communicator; please use "ssh"`)
errs = append(errs, msg)
}
-
- if c.IamInstanceProfile == "" && c.TemporaryIamInstanceProfilePolicyDocument == nil {
- msg := fmt.Errorf(`no iam_instance_profile defined; session_manager connectivity requires a valid instance profile with AmazonSSMManagedInstanceCore permissions. Alternatively a temporary_iam_instance_profile_policy_document can be used.`)
- errs = append(errs, msg)
- }
}

if c.Comm.SSHKeyPairName != "" {
@@ -961,8 +956,7 @@ func (c *RunConfig) IsSpotInstance() bool {
}

func (c *RunConfig) SSMAgentEnabled() bool {
- hasIamInstanceProfile := c.IamInstanceProfile != "" || c.TemporaryIamInstanceProfilePolicyDocument != nil
- return c.SSHInterface == "session_manager" && hasIamInstanceProfile
+ return c.SSHInterface == "session_manager"
}

// IsBurstableInstanceType checks if the InstanceType for the config is one
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.