Merge pull request #8212 from hashicorp/fix_8204

Fix 8204

builder/amazon/chroot/builder.go

@@ -408,6 +408,7 @@ func (b *Builder) Run(ctx context.Context, ui packer.Ui, hook packer.Hook) (pack
 			RootVolumeSize:           b.config.RootVolumeSize,
 			EnableAMISriovNetSupport: b.config.AMISriovNetSupport,
 			EnableAMIENASupport:      b.config.AMIENASupport,
+			AMISkipBuildRegion:       b.config.AMISkipBuildRegion,
 		},
 		&awscommon.StepAMIRegionCopy{
 			AccessConfig:      &b.config.AccessConfig,

builder/amazon/chroot/step_register_ami.go

@@ -7,6 +7,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	awscommon "github.com/hashicorp/packer/builder/amazon/common"
+	"github.com/hashicorp/packer/common/random"
 	confighelper "github.com/hashicorp/packer/helper/config"
 	"github.com/hashicorp/packer/helper/multistep"
 	"github.com/hashicorp/packer/packer"
@@ -17,6 +18,7 @@ type StepRegisterAMI struct {
 	RootVolumeSize           int64
 	EnableAMIENASupport      confighelper.Trilean
 	EnableAMISriovNetSupport bool
+	AMISkipBuildRegion       bool
 }
 
 func (s *StepRegisterAMI) Run(ctx context.Context, state multistep.StateBag) multistep.StepAction {
@@ -29,12 +31,29 @@ func (s *StepRegisterAMI) Run(ctx context.Context, state multistep.StateBag) mul
 
 	var registerOpts *ec2.RegisterImageInput
 
+	// Create the image
+	amiName := config.AMIName
+	state.Put("intermediary_image", false)
+	if config.AMIEncryptBootVolume.True() || s.AMISkipBuildRegion {
+		state.Put("intermediary_image", true)
+
+		// From AWS SDK docs: You can encrypt a copy of an unencrypted snapshot,
+		// but you cannot use it to create an unencrypted copy of an encrypted
+		// snapshot. Your default CMK for EBS is used unless you specify a
+		// non-default key using KmsKeyId.
+
+		// If encrypt_boot is nil or true, we need to create a temporary image
+		// so that in step_region_copy, we can copy it with the correct
+		// encryption
+		amiName = random.AlphaNum(7)
+	}
+
 	// Source Image is only required to be passed if the image is not from scratch
 	if config.FromScratch {
-		registerOpts = buildBaseRegisterOpts(config, nil, s.RootVolumeSize, snapshotID)
+		registerOpts = buildBaseRegisterOpts(config, nil, s.RootVolumeSize, snapshotID, amiName)
 	} else {
 		image := state.Get("source_image").(*ec2.Image)
-		registerOpts = buildBaseRegisterOpts(config, image, s.RootVolumeSize, snapshotID)
+		registerOpts = buildBaseRegisterOpts(config, image, s.RootVolumeSize, snapshotID, amiName)
 	}
 
 	if s.EnableAMISriovNetSupport {
@@ -75,7 +94,7 @@ func (s *StepRegisterAMI) Run(ctx context.Context, state multistep.StateBag) mul
 func (s *StepRegisterAMI) Cleanup(state multistep.StateBag) {}
 
 // Builds the base register opts with architecture, name, root block device, mappings, virtualizationtype
-func buildBaseRegisterOpts(config *Config, sourceImage *ec2.Image, rootVolumeSize int64, snapshotID string) *ec2.RegisterImageInput {
+func buildBaseRegisterOpts(config *Config, sourceImage *ec2.Image, rootVolumeSize int64, snapshotID string, amiName string) *ec2.RegisterImageInput {
 	var (
 		mappings       []*ec2.BlockDeviceMapping
 		rootDeviceName string
@@ -117,7 +136,7 @@ func buildBaseRegisterOpts(config *Config, sourceImage *ec2.Image, rootVolumeSiz
 
 	if config.FromScratch {
 		return &ec2.RegisterImageInput{
-			Name:                &config.AMIName,
+			Name:                &amiName,
 			Architecture:        aws.String(config.Architecture),
 			RootDeviceName:      aws.String(rootDeviceName),
 			VirtualizationType:  aws.String(config.AMIVirtType),
@@ -125,12 +144,12 @@ func buildBaseRegisterOpts(config *Config, sourceImage *ec2.Image, rootVolumeSiz
 		}
 	}
 
-	return buildRegisterOptsFromExistingImage(config, sourceImage, newMappings, rootDeviceName)
+	return buildRegisterOptsFromExistingImage(config, sourceImage, newMappings, rootDeviceName, amiName)
 }
 
-func buildRegisterOptsFromExistingImage(config *Config, image *ec2.Image, mappings []*ec2.BlockDeviceMapping, rootDeviceName string) *ec2.RegisterImageInput {
+func buildRegisterOptsFromExistingImage(config *Config, image *ec2.Image, mappings []*ec2.BlockDeviceMapping, rootDeviceName string, amiName string) *ec2.RegisterImageInput {
 	registerOpts := &ec2.RegisterImageInput{
-		Name:                &config.AMIName,
+		Name:                &amiName,
 		Architecture:        image.Architecture,
 		RootDeviceName:      &rootDeviceName,
 		BlockDeviceMappings: mappings,

builder/amazon/chroot/step_register_ami_test.go

@@ -30,7 +30,7 @@ func TestStepRegisterAmi_buildRegisterOpts_pv(t *testing.T) {
 
 	blockDevices := []*ec2.BlockDeviceMapping{}
 
-	opts := buildRegisterOptsFromExistingImage(&config, &image, blockDevices, rootDeviceName)
+	opts := buildRegisterOptsFromExistingImage(&config, &image, blockDevices, rootDeviceName, config.AMIName)
 
 	expected := config.AMIVirtType
 	if *opts.VirtualizationType != expected {
@@ -64,7 +64,7 @@ func TestStepRegisterAmi_buildRegisterOpts_hvm(t *testing.T) {
 
 	blockDevices := []*ec2.BlockDeviceMapping{}
 
-	opts := buildRegisterOptsFromExistingImage(&config, &image, blockDevices, rootDeviceName)
+	opts := buildRegisterOptsFromExistingImage(&config, &image, blockDevices, rootDeviceName, config.AMIName)
 
 	expected := config.AMIVirtType
 	if *opts.VirtualizationType != expected {
@@ -99,7 +99,7 @@ func TestStepRegisterAmi_buildRegisterOptsFromScratch(t *testing.T) {
 		},
 		RootDeviceName: rootDeviceName,
 	}
-	registerOpts := buildBaseRegisterOpts(&config, nil, 10, snapshotID)
+	registerOpts := buildBaseRegisterOpts(&config, nil, 10, snapshotID, config.AMIName)
 
 	if len(registerOpts.BlockDeviceMappings) != 1 {
 		t.Fatal("Expected block device mapping of length 1")
@@ -138,7 +138,7 @@ func TestStepRegisterAmi_buildRegisterOptFromExistingImage(t *testing.T) {
 			},
 		},
 	}
-	registerOpts := buildBaseRegisterOpts(&config, &sourceImage, 15, snapshotID)
+	registerOpts := buildBaseRegisterOpts(&config, &sourceImage, 15, snapshotID, config.AMIName)
 
 	if len(registerOpts.BlockDeviceMappings) != 2 {
 		t.Fatal("Expected block device mapping of length 2")
@@ -196,7 +196,7 @@ func TestStepRegisterAmi_buildRegisterOptFromExistingImageWithBlockDeviceMapping
 			},
 		},
 	}
-	registerOpts := buildBaseRegisterOpts(&config, &sourceImage, 15, snapshotId)
+	registerOpts := buildBaseRegisterOpts(&config, &sourceImage, 15, snapshotId, config.AMIName)
 
 	if len(registerOpts.BlockDeviceMappings) != 1 {
 		t.Fatal("Expected block device mapping of length 1")

builder/amazon/ebssurrogate/builder.go

@@ -308,6 +308,7 @@ func (b *Builder) Run(ctx context.Context, ui packer.Ui, hook packer.Hook) (pack
 			EnableAMIENASupport:      b.config.AMIENASupport,
 			Architecture:             b.config.Architecture,
 			LaunchOmitMap:            b.config.LaunchMappings.GetOmissions(),
+			AMISkipBuildRegion:       b.config.AMISkipBuildRegion,
 		},
 		&awscommon.StepAMIRegionCopy{
 			AccessConfig:      &b.config.AccessConfig,

builder/amazon/ebssurrogate/step_register_ami.go

@@ -7,6 +7,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	awscommon "github.com/hashicorp/packer/builder/amazon/common"
+	"github.com/hashicorp/packer/common/random"
 	confighelper "github.com/hashicorp/packer/helper/config"
 	"github.com/hashicorp/packer/helper/multistep"
 	"github.com/hashicorp/packer/packer"
@@ -22,6 +23,7 @@ type StepRegisterAMI struct {
 	Architecture             string
 	image                    *ec2.Image
 	LaunchOmitMap            map[string]bool
+	AMISkipBuildRegion       bool
 }
 
 func (s *StepRegisterAMI) Run(ctx context.Context, state multistep.StateBag) multistep.StepAction {
@@ -34,8 +36,25 @@ func (s *StepRegisterAMI) Run(ctx context.Context, state multistep.StateBag) mul
 
 	blockDevices := s.combineDevices(snapshotIds)
 
+	// Create the image
+	amiName := config.AMIName
+	state.Put("intermediary_image", false)
+	if config.AMIEncryptBootVolume.True() || s.AMISkipBuildRegion {
+		state.Put("intermediary_image", true)
+
+		// From AWS SDK docs: You can encrypt a copy of an unencrypted snapshot,
+		// but you cannot use it to create an unencrypted copy of an encrypted
+		// snapshot. Your default CMK for EBS is used unless you specify a
+		// non-default key using KmsKeyId.
+
+		// If encrypt_boot is nil or true, we need to create a temporary image
+		// so that in step_region_copy, we can copy it with the correct
+		// encryption
+		amiName = random.AlphaNum(7)
+	}
+
 	registerOpts := &ec2.RegisterImageInput{
-		Name:                &config.AMIName,
+		Name:                &amiName,
 		Architecture:        aws.String(s.Architecture),
 		RootDeviceName:      aws.String(s.RootDevice.DeviceName),
 		VirtualizationType:  aws.String(config.AMIVirtType),

builder/amazon/instance/builder.go

@@ -350,6 +350,7 @@ func (b *Builder) Run(ctx context.Context, ui packer.Ui, hook packer.Hook) (pack
 		&StepRegisterAMI{
 			EnableAMISriovNetSupport: b.config.AMISriovNetSupport,
 			EnableAMIENASupport:      b.config.AMIENASupport,
+			AMISkipBuildRegion:       b.config.AMISkipBuildRegion,
 		},
 		&awscommon.StepAMIRegionCopy{
 			AccessConfig:      &b.config.AccessConfig,

builder/amazon/instance/step_register_ami.go

@@ -7,6 +7,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	awscommon "github.com/hashicorp/packer/builder/amazon/common"
+	"github.com/hashicorp/packer/common/random"
 	confighelper "github.com/hashicorp/packer/helper/config"
 	"github.com/hashicorp/packer/helper/multistep"
 	"github.com/hashicorp/packer/packer"
@@ -15,6 +16,7 @@ import (
 type StepRegisterAMI struct {
 	EnableAMIENASupport      confighelper.Trilean
 	EnableAMISriovNetSupport bool
+	AMISkipBuildRegion       bool
 }
 
 func (s *StepRegisterAMI) Run(ctx context.Context, state multistep.StateBag) multistep.StepAction {
@@ -24,9 +26,27 @@ func (s *StepRegisterAMI) Run(ctx context.Context, state multistep.StateBag) mul
 	ui := state.Get("ui").(packer.Ui)
 
 	ui.Say("Registering the AMI...")
+
+	// Create the image
+	amiName := config.AMIName
+	state.Put("intermediary_image", false)
+	if config.AMIEncryptBootVolume.True() || s.AMISkipBuildRegion {
+		state.Put("intermediary_image", true)
+
+		// From AWS SDK docs: You can encrypt a copy of an unencrypted snapshot,
+		// but you cannot use it to create an unencrypted copy of an encrypted
+		// snapshot. Your default CMK for EBS is used unless you specify a
+		// non-default key using KmsKeyId.
+
+		// If encrypt_boot is nil or true, we need to create a temporary image
+		// so that in step_region_copy, we can copy it with the correct
+		// encryption
+		amiName = random.AlphaNum(7)
+	}
+
 	registerOpts := &ec2.RegisterImageInput{
 		ImageLocation:       &manifestPath,
-		Name:                aws.String(config.AMIName),
+		Name:                aws.String(amiName),
 		BlockDeviceMappings: config.AMIMappings.BuildEC2BlockDeviceMappings(),
 	}