|
|
|
|
@ -32,6 +32,53 @@ Packer supports the following builders at the moment:
|
|
|
|
|
builder](/docs/builders/amazon-ebs.html). It is much easier to use and Amazon
|
|
|
|
|
generally recommends EBS-backed images nowadays.
|
|
|
|
|
|
|
|
|
|
<div id="specifying-amazon-credentials">
|
|
|
|
|
|
|
|
|
|
\#\# Specifying Amazon Credentials
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
When you use any of the amazon builders, you must provide credentials to the API
|
|
|
|
|
in the form of an access key id and secret. These look like:
|
|
|
|
|
|
|
|
|
|
access key id: AKIAIOSFODNN7EXAMPLE
|
|
|
|
|
secret access key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
|
|
|
|
|
|
|
|
|
If you use other AWS tools you may already have these configured. If so, packer
|
|
|
|
|
will try to use them, *unless* they are specified in your packer template.
|
|
|
|
|
Credentials are resolved in the following order:
|
|
|
|
|
|
|
|
|
|
1. Values hard-coded in the packer template are always authoritative.
|
|
|
|
|
2. *Variables* in the packer template may be resolved from command-line flags
|
|
|
|
|
or from environment variables. Please read about [User
|
|
|
|
|
Variables](https://packer.io/docs/templates/user-variables.html)
|
|
|
|
|
for details.
|
|
|
|
|
3. If no credentials are found, packer falls back to automatic lookup.
|
|
|
|
|
|
|
|
|
|
### Automatic Lookup
|
|
|
|
|
|
|
|
|
|
If no AWS credentials are found in a packer template, we proceed on to the
|
|
|
|
|
following steps:
|
|
|
|
|
|
|
|
|
|
1. Lookup via environment variables.
|
|
|
|
|
- First `AWS_ACCESS_KEY_ID`, then `AWS_ACCESS_KEY`
|
|
|
|
|
- First `AWS_SECRET_ACCESS_KEY`, then `AWS_SECRET_KEY`
|
|
|
|
|
|
|
|
|
|
2. Look for [local AWS configuration
|
|
|
|
|
files](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files)
|
|
|
|
|
- First `~/.aws/credentials`
|
|
|
|
|
- Next based on `AWS_PROFILE`
|
|
|
|
|
|
|
|
|
|
3. Lookup an IAM role for the current EC2 instance (if you're running in EC2)
|
|
|
|
|
|
|
|
|
|
\~> **Subtle details of automatic lookup may change over time.** The most
|
|
|
|
|
reliable way to specify your configuration is by setting them in template
|
|
|
|
|
variables (directly or indirectly), or by using the `AWS_ACCESS_KEY_ID` and
|
|
|
|
|
`AWS_SECRET_ACCESS_KEY` environment variables.
|
|
|
|
|
|
|
|
|
|
Environment variables provide the best portability, allowing you to run your
|
|
|
|
|
packer build on your workstation, in Atlas, or on another build server.
|
|
|
|
|
|
|
|
|
|
## Using an IAM Instance Profile
|
|
|
|
|
|
|
|
|
|
If AWS keys are not specified in the template, a
|
|
|
|
|
@ -74,3 +121,29 @@ Packer to work:
|
|
|
|
|
}]
|
|
|
|
|
}
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Troubleshooting
|
|
|
|
|
|
|
|
|
|
### Attaching IAM Policies to Roles
|
|
|
|
|
|
|
|
|
|
IAM policies can be associated with user or roles. If you use packer with IAM
|
|
|
|
|
roles, you may encounter an error like this one:
|
|
|
|
|
|
|
|
|
|
==> amazon-ebs: Error launching source instance: You are not authorized to perform this operation.
|
|
|
|
|
|
|
|
|
|
You can read more about why this happens on the [Amazon Security
|
|
|
|
|
Blog](http://blogs.aws.amazon.com/security/post/Tx3M0IFB5XBOCQX/Granting-Permission-to-Launch-EC2-Instances-with-IAM-Roles-PassRole-Permission).
|
|
|
|
|
The example policy below may help packer work with IAM roles. Note that this
|
|
|
|
|
example provides more than the minimal set of permissions needed for packer to
|
|
|
|
|
work, but specifics will depend on your use-case.
|
|
|
|
|
|
|
|
|
|
``` {.json}
|
|
|
|
|
{
|
|
|
|
|
"Sid": "PackerIAMPassRole",
|
|
|
|
|
"Effect": "Allow",
|
|
|
|
|
"Action": "iam:PassRole",
|
|
|
|
|
"Resource": [
|
|
|
|
|
"*"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
```
|
|
|
|
|
|
Chris Bednarski
11 years ago