hashicorp / hashicorp/packer-plugin-amazon
Allow IamInstanceProfile to be optional when using SSM
- Dominant language
- Go
- Stars
- 91
- Forks
- 141
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 3
Description
On my organization's AWS account, I get permission errors when using either IamInstanceProfile or TemporaryIamInstanceProfilePolicyDocument options. However, this account has been configured so that SSM is usable regardless (I believe due to "SSM Quick Start" being configured on the account) - any launched EC2 machine automatically gets added an IAM instance profile that permits SSM.
Unfortunately, there are currently validation checks that require non-empty IamInstanceProfile when SSM is enabled, making packer with SSM unusable for me. I have tested that simply removing the checks makes this work for me:
```
diff --git a/builder/common/run_config.go b/builder/common/run_config.go
index 16dc8cf82860..b13842778a33 100644
--- a/builder/common/run_config.go
+++ b/builder/common/run_config.go
@@ -796,11 +796,6 @@ func (c *RunConfig) Prepare(ctx *interpolate.Context) []error {
msg := fmt.Errorf(`session_manager connectivity is not supported with the "winrm" communicator; please use "ssh"`)
errs = append(errs, msg)
}
-
- if c.IamInstanceProfile == "" && c.TemporaryIamInstanceProfilePolicyDocument == nil {
- msg := fmt.Errorf(`no iam_instance_profile defined; session_manager connectivity requires a valid instance profile with AmazonSSMManagedInstanceCore permissions. Alternatively a temporary_iam_instance_profile_policy_document can be used.`)
- errs = append(errs, msg)
- }
}
if c.Comm.SSHKeyPairName != "" {
@@ -963,8 +958,7 @@ func (c *RunConfig) IsSpotInstance() bool {
}
func (c *RunConfig) SSMAgentEnabled() bool {
- hasIamInstanceProfile := c.IamInstanceProfile != "" || c.TemporaryIamInstanceProfilePolicyDocument != nil
- return c.SSHInterface == "session_manager" && hasIamInstanceProfile
+ return c.SSHInterface == "session_manager"
}
// IsBurstableInstanceType checks if the InstanceType for the config is one
diff --git a/common/run_config.go b/common/run_config.go
index d35eb3538c84..732c2823cf4b 100644
--- a/common/run_config.go
+++ b/common/run_config.go
@@ -793,11 +793,6 @@ func (c *RunConfig) Prepare(ctx *interpolate.Context) []error {
msg := fmt.Errorf(`session_manager connectivity is not supported with the "winrm" communicator; please use "ssh"`)
errs = append(errs, msg)
}
-
- if c.IamInstanceProfile == "" && c.TemporaryIamInstanceProfilePolicyDocument == nil {
- msg := fmt.Errorf(`no iam_instance_profile defined; session_manager connectivity requires a valid instance profile with AmazonSSMManagedInstanceCore permissions. Alternatively a temporary_iam_instance_profile_policy_document can be used.`)
- errs = append(errs, msg)
- }
}
if c.Comm.SSHKeyPairName != "" {
@@ -961,8 +956,7 @@ func (c *RunConfig) IsSpotInstance() bool {
}
func (c *RunConfig) SSMAgentEnabled() bool {
- hasIamInstanceProfile := c.IamInstanceProfile != "" || c.TemporaryIamInstanceProfilePolicyDocument != nil
- return c.SSHInterface == "session_manager" && hasIamInstanceProfile
+ return c.SSHInterface == "session_manager"
}
// IsBurstableInstanceType checks if the InstanceType for the config is one
```
Contributor guide
Assessment
This issue has not been assessed yet.