Reformat
This commit is contained in:
Chris Bednarski
parent
99061b96d6
commit
3fe2d2f5bc
@ -60,19 +60,20 @@ builder.
|
|||||||
|
|
||||||
### Required:
|
### Required:
|
||||||
|
|
||||||
* `access_key` (string) - The access key used to communicate with AWS. [Learn how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
- `access_key` (string) - The access key used to communicate with AWS. [Learn
|
||||||
|
how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
||||||
|
|
||||||
* `ami_name` (string) - The name of the resulting AMI that will appear
|
- `ami_name` (string) - The name of the resulting AMI that will appear when
|
||||||
when managing AMIs in the AWS console or via APIs. This must be unique.
|
managing AMIs in the AWS console or via APIs. This must be unique. To help
|
||||||
To help make this unique, use a function like `timestamp` (see
|
make this unique, use a function like `timestamp` (see [configuration
|
||||||
[configuration templates](/docs/templates/configuration-templates.html) for more info)
|
templates](/docs/templates/configuration-templates.html) for more info)
|
||||||
|
|
||||||
* `secret_key` (string) - The secret key used to communicate with AWS.
|
- `secret_key` (string) - The secret key used to communicate with AWS. [Learn
|
||||||
[Learn how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
||||||
|
|
||||||
* `source_ami` (string) - The source AMI whose root volume will be copied
|
- `source_ami` (string) - The source AMI whose root volume will be copied and
|
||||||
and provisioned on the currently running instance. This must be an
|
provisioned on the currently running instance. This must be an EBS-backed
|
||||||
EBS-backed AMI with a root volume snapshot that you have access to.
|
AMI with a root volume snapshot that you have access to.
|
||||||
|
|
||||||
### Optional:
|
### Optional:
|
||||||
|
|
||||||
|
|||||||
@ -40,26 +40,28 @@ builder.
|
|||||||
|
|
||||||
### Required:
|
### Required:
|
||||||
|
|
||||||
* `access_key` (string) - The access key used to communicate with AWS. [Learn how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
- `access_key` (string) - The access key used to communicate with AWS. [Learn
|
||||||
|
how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
||||||
|
|
||||||
* `ami_name` (string) - The name of the resulting AMI that will appear
|
- `ami_name` (string) - The name of the resulting AMI that will appear when
|
||||||
when managing AMIs in the AWS console or via APIs. This must be unique.
|
managing AMIs in the AWS console or via APIs. This must be unique. To help
|
||||||
To help make this unique, use a function like `timestamp` (see
|
make this unique, use a function like `timestamp` (see [configuration
|
||||||
[configuration templates](/docs/templates/configuration-templates.html) for more info)
|
templates](/docs/templates/configuration-templates.html) for more info)
|
||||||
|
|
||||||
* `instance_type` (string) - The EC2 instance type to use while building
|
- `instance_type` (string) - The EC2 instance type to use while building the
|
||||||
the AMI, such as "m1.small".
|
AMI, such as "m1.small".
|
||||||
|
|
||||||
* `region` (string) - The name of the region, such as "us-east-1", in which
|
- `region` (string) - The name of the region, such as "us-east-1", in which to
|
||||||
to launch the EC2 instance to create the AMI.
|
launch the EC2 instance to create the AMI.
|
||||||
|
|
||||||
* `secret_key` (string) - The secret key used to communicate with AWS. [Learn how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
- `secret_key` (string) - The secret key used to communicate with AWS. [Learn
|
||||||
|
how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
||||||
|
|
||||||
* `source_ami` (string) - The initial AMI used as a base for the newly
|
- `source_ami` (string) - The initial AMI used as a base for the newly
|
||||||
created machine.
|
created machine.
|
||||||
|
|
||||||
* `ssh_username` (string) - The username to use in order to communicate
|
- `ssh_username` (string) - The username to use in order to communicate over
|
||||||
over SSH to the running machine.
|
SSH to the running machine.
|
||||||
|
|
||||||
### Optional:
|
### Optional:
|
||||||
|
|
||||||
|
|||||||
@ -45,41 +45,44 @@ builder.
|
|||||||
|
|
||||||
### Required:
|
### Required:
|
||||||
|
|
||||||
* `access_key` (string) - The access key used to communicate with AWS. [Learn how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
- `access_key` (string) - The access key used to communicate with AWS. [Learn
|
||||||
|
how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
||||||
|
|
||||||
* `account_id` (string) - Your AWS account ID. This is required for bundling
|
- `account_id` (string) - Your AWS account ID. This is required for bundling
|
||||||
the AMI. This is _not the same_ as the access key. You can find your
|
the AMI. This is *not the same* as the access key. You can find your account
|
||||||
account ID in the security credentials page of your AWS account.
|
ID in the security credentials page of your AWS account.
|
||||||
|
|
||||||
* `ami_name` (string) - The name of the resulting AMI that will appear
|
- `ami_name` (string) - The name of the resulting AMI that will appear when
|
||||||
when managing AMIs in the AWS console or via APIs. This must be unique.
|
managing AMIs in the AWS console or via APIs. This must be unique. To help
|
||||||
To help make this unique, use a function like `timestamp` (see
|
make this unique, use a function like `timestamp` (see [configuration
|
||||||
[configuration templates](/docs/templates/configuration-templates.html) for more info)
|
templates](/docs/templates/configuration-templates.html) for more info)
|
||||||
|
|
||||||
* `instance_type` (string) - The EC2 instance type to use while building
|
- `instance_type` (string) - The EC2 instance type to use while building the
|
||||||
the AMI, such as "m1.small".
|
AMI, such as "m1.small".
|
||||||
|
|
||||||
* `region` (string) - The name of the region, such as "us-east-1", in which
|
- `region` (string) - The name of the region, such as "us-east-1", in which to
|
||||||
to launch the EC2 instance to create the AMI.
|
launch the EC2 instance to create the AMI.
|
||||||
|
|
||||||
* `s3_bucket` (string) - The name of the S3 bucket to upload the AMI.
|
- `s3_bucket` (string) - The name of the S3 bucket to upload the AMI. This
|
||||||
This bucket will be created if it doesn't exist.
|
bucket will be created if it doesn't exist.
|
||||||
|
|
||||||
* `secret_key` (string) - The secret key used to communicate with AWS. [Learn how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
- `secret_key` (string) - The secret key used to communicate with AWS. [Learn
|
||||||
|
how to set this.](/docs/builders/amazon.html#specifying-amazon-credentials)
|
||||||
|
|
||||||
* `source_ami` (string) - The initial AMI used as a base for the newly
|
- `source_ami` (string) - The initial AMI used as a base for the newly
|
||||||
created machine.
|
created machine.
|
||||||
|
|
||||||
* `ssh_username` (string) - The username to use in order to communicate
|
- `ssh_username` (string) - The username to use in order to communicate over
|
||||||
over SSH to the running machine.
|
SSH to the running machine.
|
||||||
|
|
||||||
* `x509_cert_path` (string) - The local path to a valid X509 certificate for
|
- `x509_cert_path` (string) - The local path to a valid X509 certificate for
|
||||||
your AWS account. This is used for bundling the AMI. This X509 certificate
|
your AWS account. This is used for bundling the AMI. This X509 certificate
|
||||||
must be registered with your account from the security credentials page
|
must be registered with your account from the security credentials page in
|
||||||
in the AWS console.
|
the AWS console.
|
||||||
|
|
||||||
* `x509_key_path` (string) - The local path to the private key for the X509
|
- `x509_key_path` (string) - The local path to the private key for the X509
|
||||||
certificate specified by `x509_cert_path`. This is used for bundling the AMI.
|
certificate specified by `x509_cert_path`. This is used for bundling
|
||||||
|
the AMI.
|
||||||
|
|
||||||
### Optional:
|
### Optional:
|
||||||
|
|
||||||
|
|||||||
@ -9,57 +9,75 @@ page_title: Amazon AMI Builder
|
|||||||
# Amazon AMI Builder
|
# Amazon AMI Builder
|
||||||
|
|
||||||
Packer is able to create Amazon AMIs. To achieve this, Packer comes with
|
Packer is able to create Amazon AMIs. To achieve this, Packer comes with
|
||||||
multiple builders depending on the strategy you want to use to build the
|
multiple builders depending on the strategy you want to use to build the AMI.
|
||||||
AMI. Packer supports the following builders at the moment:
|
Packer supports the following builders at the moment:
|
||||||
|
|
||||||
* [amazon-ebs](/docs/builders/amazon-ebs.html) - Create EBS-backed AMIs
|
- [amazon-ebs](/docs/builders/amazon-ebs.html) - Create EBS-backed AMIs by
|
||||||
by launching a source AMI and re-packaging it into a new AMI after
|
launching a source AMI and re-packaging it into a new AMI
|
||||||
provisioning. If in doubt, use this builder, which is the easiest to get
|
after provisioning. If in doubt, use this builder, which is the easiest to
|
||||||
started with.
|
get started with.
|
||||||
|
|
||||||
* [amazon-instance](/docs/builders/amazon-instance.html) - Create
|
- [amazon-instance](/docs/builders/amazon-instance.html) - Create
|
||||||
instance-store AMIs by launching and provisioning a source instance, then
|
instance-store AMIs by launching and provisioning a source instance, then
|
||||||
rebundling it and uploading it to S3.
|
rebundling it and uploading it to S3.
|
||||||
|
|
||||||
* [amazon-chroot](/docs/builders/amazon-chroot.html) - Create EBS-backed AMIs
|
- [amazon-chroot](/docs/builders/amazon-chroot.html) - Create EBS-backed AMIs
|
||||||
from an existing EC2 instance by mounting the root device and using a
|
from an existing EC2 instance by mounting the root device and using a
|
||||||
[Chroot](http://en.wikipedia.org/wiki/Chroot) environment to provision
|
[Chroot](http://en.wikipedia.org/wiki/Chroot) environment to provision
|
||||||
that device. This is an **advanced builder and should not be used by
|
that device. This is an **advanced builder and should not be used by
|
||||||
newcomers**. However, it is also the fastest way to build an EBS-backed
|
newcomers**. However, it is also the fastest way to build an EBS-backed AMI
|
||||||
AMI since no new EC2 instance needs to be launched.
|
since no new EC2 instance needs to be launched.
|
||||||
|
|
||||||
-> **Don't know which builder to use?** If in doubt, use the
|
-> **Don't know which builder to use?** If in doubt, use the [amazon-ebs
|
||||||
[amazon-ebs builder](/docs/builders/amazon-ebs.html). It is
|
builder](/docs/builders/amazon-ebs.html). It is much easier to use and Amazon
|
||||||
much easier to use and Amazon generally recommends EBS-backed images nowadays.
|
generally recommends EBS-backed images nowadays.
|
||||||
|
|
||||||
<div id="specifying-amazon-credentials">## Specifying Amazon Credentials</div>
|
<div id="specifying-amazon-credentials">
|
||||||
|
|
||||||
When you use any of the amazon builders, you must provide credentials to the API in the form of an access key id and secret. These look like:
|
\#\# Specifying Amazon Credentials
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When you use any of the amazon builders, you must provide credentials to the API
|
||||||
|
in the form of an access key id and secret. These look like:
|
||||||
|
|
||||||
access key id: AKIAIOSFODNN7EXAMPLE
|
access key id: AKIAIOSFODNN7EXAMPLE
|
||||||
secret access key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
secret access key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
||||||
|
|
||||||
If you use other AWS tools you may already have these configured. If so, packer will try to use them, *unless* they are specified in your packer template. Credentials are resolved in the following order:
|
If you use other AWS tools you may already have these configured. If so, packer
|
||||||
|
will try to use them, *unless* they are specified in your packer template.
|
||||||
|
Credentials are resolved in the following order:
|
||||||
|
|
||||||
1. Values hard-coded in the packer template are always authoritative.
|
1. Values hard-coded in the packer template are always authoritative.
|
||||||
2. *Variables* in the packer template may be resolved from command-line flags or from environment variables. Please read about [User Variables](https://packer.io/docs/templates/user-variables.html) for details.
|
2. *Variables* in the packer template may be resolved from command-line flags
|
||||||
3. If no credentials are found, packer falls back to automatic lookup.
|
or from environment variables. Please read about [User
|
||||||
|
Variables](https://packer.io/docs/templates/user-variables.html)
|
||||||
|
for details.
|
||||||
|
3. If no credentials are found, packer falls back to automatic lookup.
|
||||||
|
|
||||||
### Automatic Lookup
|
### Automatic Lookup
|
||||||
|
|
||||||
If no AWS credentials are found in a packer template, we proceed on to the following steps:
|
If no AWS credentials are found in a packer template, we proceed on to the
|
||||||
|
following steps:
|
||||||
|
|
||||||
1. Lookup via environment variables.
|
1. Lookup via environment variables.
|
||||||
- First `AWS_ACCESS_KEY_ID`, then `AWS_ACCESS_KEY`
|
- First `AWS_ACCESS_KEY_ID`, then `AWS_ACCESS_KEY`
|
||||||
- First `AWS_SECRET_ACCESS_KEY`, then `AWS_SECRET_KEY`
|
- First `AWS_SECRET_ACCESS_KEY`, then `AWS_SECRET_KEY`
|
||||||
2. Look for [local AWS configuration files](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files)
|
|
||||||
- First `~/.aws/credentials`
|
|
||||||
- Next based on `AWS_PROFILE`
|
|
||||||
3. Lookup an IAM role for the current EC2 instance (if you're running in EC2)
|
|
||||||
|
|
||||||
~> **Subtle details of automatic lookup may change over time.** The most reliable way to specify your configuration is by setting them in template variables (directly or indirectly), or by using the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables.
|
2. Look for [local AWS configuration
|
||||||
|
files](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files)
|
||||||
|
- First `~/.aws/credentials`
|
||||||
|
- Next based on `AWS_PROFILE`
|
||||||
|
|
||||||
Environment variables provide the best portability, allowing you to run your packer build on your workstation, in Atlas, or on another build server.
|
3. Lookup an IAM role for the current EC2 instance (if you're running in EC2)
|
||||||
|
|
||||||
|
\~> **Subtle details of automatic lookup may change over time.** The most
|
||||||
|
reliable way to specify your configuration is by setting them in template
|
||||||
|
variables (directly or indirectly), or by using the `AWS_ACCESS_KEY_ID` and
|
||||||
|
`AWS_SECRET_ACCESS_KEY` environment variables.
|
||||||
|
|
||||||
|
Environment variables provide the best portability, allowing you to run your
|
||||||
|
packer build on your workstation, in Atlas, or on another build server.
|
||||||
|
|
||||||
## Using an IAM Instance Profile
|
## Using an IAM Instance Profile
|
||||||
|
|
||||||
@ -108,13 +126,18 @@ Packer to work:
|
|||||||
|
|
||||||
### Attaching IAM Policies to Roles
|
### Attaching IAM Policies to Roles
|
||||||
|
|
||||||
IAM policies can be associated with user or roles. If you use packer with IAM roles, you may encounter an error like this one:
|
IAM policies can be associated with user or roles. If you use packer with IAM
|
||||||
|
roles, you may encounter an error like this one:
|
||||||
|
|
||||||
==> amazon-ebs: Error launching source instance: You are not authorized to perform this operation.
|
==> amazon-ebs: Error launching source instance: You are not authorized to perform this operation.
|
||||||
|
|
||||||
You can read more about why this happens on the [Amazon Security Blog](http://blogs.aws.amazon.com/security/post/Tx3M0IFB5XBOCQX/Granting-Permission-to-Launch-EC2-Instances-with-IAM-Roles-PassRole-Permission). The example policy below may help packer work with IAM roles. Note that this example provides more than the minimal set of permissions needed for packer to work, but specifics will depend on your use-case.
|
You can read more about why this happens on the [Amazon Security
|
||||||
|
Blog](http://blogs.aws.amazon.com/security/post/Tx3M0IFB5XBOCQX/Granting-Permission-to-Launch-EC2-Instances-with-IAM-Roles-PassRole-Permission).
|
||||||
|
The example policy below may help packer work with IAM roles. Note that this
|
||||||
|
example provides more than the minimal set of permissions needed for packer to
|
||||||
|
work, but specifics will depend on your use-case.
|
||||||
|
|
||||||
```json
|
``` {.json}
|
||||||
{
|
{
|
||||||
"Sid": "PackerIAMPassRole",
|
"Sid": "PackerIAMPassRole",
|
||||||
"Effect": "Allow",
|
"Effect": "Allow",
|
||||||
|
|||||||
@ -77,10 +77,14 @@ If you're using OS X and [Homebrew](http://brew.sh), you can install Packer:
|
|||||||
|
|
||||||
## Troubleshooting
|
## Troubleshooting
|
||||||
|
|
||||||
On some RedHat-based Linux distributions there is another tool named `packer` installed by default. You can check for this using `which -a packer`. If you get an error like this it indicates there is a name conflict.
|
On some RedHat-based Linux distributions there is another tool named `packer`
|
||||||
|
installed by default. You can check for this using `which -a packer`. If you get
|
||||||
|
an error like this it indicates there is a name conflict.
|
||||||
|
|
||||||
$ packer
|
$ packer
|
||||||
/usr/share/cracklib/pw_dict.pwd: Permission denied
|
/usr/share/cracklib/pw_dict.pwd: Permission denied
|
||||||
/usr/share/cracklib/pw_dict: Permission denied
|
/usr/share/cracklib/pw_dict: Permission denied
|
||||||
|
|
||||||
To fix this, you can create a symlink to packer that uses a different name like `packer.io`, or invoke the `packer` binary you want using its absolute path, e.g. `/usr/local/packer`.
|
To fix this, you can create a symlink to packer that uses a different name like
|
||||||
|
`packer.io`, or invoke the `packer` binary you want using its absolute path,
|
||||||
|
e.g. `/usr/local/packer`.
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user