Packer を Systems Manager オートメーションランブック AWS-RunPacker で実行してみた

#
# Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this
# software and associated documentation files (the "Software"), to deal in the Software
# without restriction, including without limitation the rights to use, copy, modify,
# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
---
description: |
  ### Document Name - AWS-RunPacker

  ## What does this document do?
  This document uses the HashiCorp [packer](https://www.packer.io/) tool to validate, fix, or build packer templates that are used to create machine images. This document is using Packer v1.7.2.

  ## Input Parameters
  * TemplateS3BucketName: The name of the Amazon S3 bucket containing the packer template.
  * TemplateFileName: The name, or key, of the template file in the S3 bucket.
  * Mode: The mode, or command, in which to use Packer when validating against the template:
      * [Build](https://www.packer.io/docs/commands/build.html): (Default) Runs all the builds within the template in order to generate a set of artifacts.
      * [Validate](https://www.packer.io/docs/commands/validate.html): Validates the syntax and configuration of the template.
      * [Fix](https://www.packer.io/docs/commands/fix.html): Finds backwards incompatible content in the template and updates it for use with the latest version of Packer. It then uploads the fixed template to the S3 bucket that you specify. The name of the fixed template is identical to the template provided by the user, but with "fixed-" prepended to the name.
  * [Force](https://www.packer.io/docs/commands/build.html#force): Forces a builder to run when artifacts from a previous build otherwise prevent a build from running.
      * True: (Default) Force flag is used
      * False: Force flag is not used
  * AutomationAssumeRole: The ARN of the role that allows Automation to perform the actions on your behalf.

  ## Output Parameters
  * RunPackerProcessTemplate.output: The stdout from the Packer tool.
  * RunPackerProcessTemplate.fixed_template_key: The name of the template stored in an S3 bucket to use only when running in "Fix" mode.
  * RunPackerProcessTemplate.s3_bucket: The name of the S3 bucket that contains the fixed template to use only when running in "Fix" mode.
schemaVersion: '0.3'
assumeRole: "{{ AutomationAssumeRole }}"
parameters:
  TemplateS3BucketName:
    type: String
    description: "(Required) AWS S3 bucket name that stores the template. eg. my-packer-bucket"
  TemplateFileName:
    type: String
    description: "(Required) Packer template file key in the bucket. eg. path/to/packer-template.json"
  Mode:
    type: String
    description: "(Required) The mode in which to use Packer when validating against the template. Default Value - Build"
    allowedValues:
      - Validate
      - Fix
      - Build
    default: 'Build'
  Force:
    type: String
    description: "(Optional) Forces a builder to run when artifacts from a previous build otherwise prevent a build from running. Default Value - True"
    allowedValues:
      - 'True'
      - 'False'
    default: 'True'
  AutomationAssumeRole:
    type: String
    description: (Optional) The ARN of the role that allows Automation to perform the actions on your behalf.
    default: ''
outputs:
  - RunPackerProcessTemplate.output
  - RunPackerProcessTemplate.fixed_template_key
  - RunPackerProcessTemplate.s3_bucket
mainSteps:
- name: RunPackerProcessTemplate
  action: aws:executeScript
  timeoutSeconds: 600
  description: |
    ## RunPackerProcessTemplate
    Runs the selected mode against the template using the Packer tool
    ## Outputs
    * output: The stdout from the packer tool
    * Fixed_template_key: The name of the fixed template in S3 if run in "Fix" mode. No value otherwise
    * s3_bucket: The name of your s3 that contains the fixed template if run in "Fix" mode. No value otherwise
  inputs:
    Runtime: python3.6
    Handler: run_packer_handler
    Attachment: packer_1.7.2_linux_amd64.zip
    InputPayload:
        TemplateFileName: '{{TemplateFileName}}'
        TemplateS3BucketName: '{{TemplateS3BucketName}}'
        Mode: '{{Mode}}'
        Force: '{{Force}}'

    Script: |
      import os
      import glob
      import boto3
      import subprocess
      from pathlib import Path
      import json

      def get_current_dir():
        current_path = os.path.realpath(__file__)
        p = Path(current_path)
        return str(p.parent)

      def execute_packer_command(cmdArray):
        p = subprocess.Popen(cmdArray, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        out, err = [(x.decode("utf-8")) for x in p.communicate()]
        return_code = p.returncode
        if err != "":
          raise Exception("ERROR IN EXECUTING PACKER", err)
        if return_code != 0:
          raise Exception("FAILED", out)
        return out

      def download_file(path, key, bucket_name):
        s3 = boto3.client('s3')
        s3.download_file(bucket_name, key, path)

      def upload_file(path, key, bucket_name):
        s3 = boto3.client('s3')
        s3.upload_file(path, bucket_name, key)

      def validate_template(packer_cmd, template_path):
        validate_template_cmd = [packer_cmd, "validate", template_path]
        out = execute_packer_command(validate_template_cmd)
        print("Template validated successfully")
        return out

      def build_template(packer_cmd, template_path, force_build):
        build_command = [packer_cmd, "build"]
        if force_build == "True":
            build_command.extend(["-machine-readable", "-force"])
        build_command.append(template_path)
        out = execute_packer_command(build_command)
        print("Template built")
        return out

      def fix_template(packer_cmd, local_template_path, s3_template_path, bucket_name):
          s3_path_head, template_file_name = os.path.split(s3_template_path)
          fixed_template_file_name = "fixed-" + template_file_name
          fixed_template_path = os.path.join('/tmp/', fixed_template_file_name)
          fixed_template_cmd = [packer_cmd, "fix", local_template_path]
          out = execute_packer_command(fixed_template_cmd)
          fixed_template_file = open(fixed_template_path, "w")
          fixed_template_file.write(out)
          fixed_template_file.close()
          fixed_s3_key = os.path.join(s3_path_head, fixed_template_file_name)
          upload_file(fixed_template_path, fixed_s3_key, bucket_name)
          print ("Template fixed from " + s3_template_path + " to " + fixed_s3_key)
          return out, fixed_s3_key

      def run_packer_handler(events, context):
        current_dir = get_current_dir()
        packer_cmd = current_dir + "/" + "packer"
        s3_template_path = events['TemplateFileName']
        bucket_name = events['TemplateS3BucketName']
        mode = events['Mode']
        force_build = events['Force']
        s3_path_head, file_name = os.path.split(s3_template_path)
        local_template_path = os.path.join("/tmp/", file_name)
        download_file(local_template_path, s3_template_path, bucket_name)

        os.system("chmod u=x " + packer_cmd)

        fixed_template_path = ""
        ret_bucket_value = ""
        if mode == "Validate":
            out = validate_template(packer_cmd, local_template_path)
        elif mode == "Build":
            out = build_template(packer_cmd, local_template_path, force_build)
        elif mode == "Fix":
            out, fixed_template_path = fix_template(packer_cmd, local_template_path, s3_template_path, bucket_name)
            ret_bucket_value = bucket_name
        return {
          'output': json.dumps(out),
          'fixed_template_key': fixed_template_path,
          's3_bucket': ret_bucket_value
        }
  isEnd: true
  outputs:
    - Name: output
      Selector: $.Payload.output
      Type: String
    - Name: fixed_template_key
      Selector: $.Payload.fixed_template_key
      Type: String
    - Name: s3_bucket
      Selector: $.Payload.s3_bucket
      Type: String
files:
  packer_1.7.2_linux_amd64.zip:
    checksums:
      sha256: 9429c3a6f80b406dbddb9b30a4e468aeac59ab6ae4d09618c8d70c4f4188442e
    size: 28738303
...

"1623084960,,ui,say,==> amazon-ebs: Force Deregister flag found%!(PACKER_COMMA) skipping prevalidating AMI Name
1623084960,,ui,message,    amazon-ebs: Found Image ID: ami-0ca38c7440de1749a
1623084960,,ui,say,==> amazon-ebs: Creating temporary keypair: packer_60be4f9f-20cd-34ea-3572-bf7056d76453
1623084960,,ui,say,==> amazon-ebs: Creating temporary security group for this instance: packer_60be4fa0-ea14-2e60-6593-168770925689
1623084960,,ui,say,==> amazon-ebs: Authorizing access to port 22 from [0.0.0.0/0] in the temporary security groups...
1623084961,,ui,say,==> amazon-ebs: Launching a source AWS instance...
1623084961,,ui,say,==> amazon-ebs: Adding tags to source instance
1623084961,,ui,message,    amazon-ebs: Adding tag: \"Name\": \"Packer Builder\"
1623084962,,ui,message,    amazon-ebs: Instance ID: i-002ca33d541534f99
1623084962,,ui,say,==> amazon-ebs: Waiting for instance (i-002ca33d541534f99) to become ready...
1623084977,,ui,say,==> amazon-ebs: Using ssh communicator to connect: 18.183.91.191
1623084977,,ui,say,==> amazon-ebs: Waiting for SSH to become available...
1623084990,,ui,say,==> amazon-ebs: Connected to SSH!
1623084990,,ui,say,==> amazon-ebs: Provisioning with shell script: /tmp/packer-shell059834347
1623084991,,ui,message,    amazon-ebs: Loaded plugins: extras_suggestions%!(PACKER_COMMA) langpacks%!(PACKER_COMMA) priorities%!(PACKER_COMMA) update-motd
1623084991,,ui,error,==> amazon-ebs: Existing lock /var/run/yum.pid: another copy is running as pid 2398.
1623084991,,ui,error,==> amazon-ebs: Another app is currently holding the yum lock; waiting for it to exit...
1623084991,,ui,error,==> amazon-ebs:   The other application is: yum
1623084991,,ui,error,==> amazon-ebs:     Memory : 105 M RSS (418 MB VSZ)
1623084991,,ui,error,==> amazon-ebs:     Started: Mon Jun  7 16:56:25 2021 - 00:06 ago
1623084991,,ui,error,==> amazon-ebs:     State  : Running%!(PACKER_COMMA) pid: 2398
1623084993,,ui,error,==> amazon-ebs: Existing lock /var/run/yum.pid: another copy is running as pid 2532.
1623084993,,ui,error,==> amazon-ebs: Another app is currently holding the yum lock; waiting for it to exit...
1623084993,,ui,error,==> amazon-ebs:   The other application is: yum
1623084993,,ui,error,==> amazon-ebs:     Memory :  53 M RSS (269 MB VSZ)
1623084993,,ui,error,==> amazon-ebs:     Started: Mon Jun  7 16:56:31 2021 - 00:02 ago
1623084993,,ui,error,==> amazon-ebs:     State  : Running%!(PACKER_COMMA) pid: 2532
1623084995,,ui,error,==> amazon-ebs: Another app is currently holding the yum lock; waiting for it to exit...
1623084995,,ui,error,==> amazon-ebs:   The other application is: yum
1623084995,,ui,error,==> amazon-ebs:     Memory : 143 M RSS (360 MB VSZ)
1623084995,,ui,error,==> amazon-ebs:     Started: Mon Jun  7 16:56:31 2021 - 00:04 ago
1623084995,,ui,error,==> amazon-ebs:     State  : Running%!(PACKER_COMMA) pid: 2532
1623084997,,ui,message,    amazon-ebs: Resolving Dependencies
1623084997,,ui,message,    amazon-ebs: --> Running transaction check
1623084997,,ui,message,    amazon-ebs: ---> Package tree.x86_64 0:1.6.0-10.amzn2.0.1 will be installed
1623084997,,ui,message,    amazon-ebs: --> Finished Dependency Resolution
1623084997,,ui,message,    amazon-ebs:
1623084997,,ui,message,    amazon-ebs: Dependencies Resolved
1623084997,,ui,message,    amazon-ebs:
1623084997,,ui,message,    amazon-ebs: ================================================================================
1623084997,,ui,message,    amazon-ebs:  Package     Arch          Version                      Repository         Size
1623084997,,ui,message,    amazon-ebs: ================================================================================
1623084997,,ui,message,    amazon-ebs: Installing:
1623084997,,ui,message,    amazon-ebs:  tree        x86_64        1.6.0-10.amzn2.0.1           amzn2-core         47 k
1623084997,,ui,message,    amazon-ebs:
1623084997,,ui,message,    amazon-ebs: Transaction Summary
1623084997,,ui,message,    amazon-ebs: ================================================================================
1623084997,,ui,message,    amazon-ebs: Install  1 Package
1623084997,,ui,message,    amazon-ebs:
1623084997,,ui,message,    amazon-ebs: Total download size: 47 k
1623084997,,ui,message,    amazon-ebs: Installed size: 83 k
1623084997,,ui,message,    amazon-ebs: Downloading packages:
1623084997,,ui,message,    amazon-ebs: Running transaction check
1623084997,,ui,message,    amazon-ebs: Running transaction test
1623084997,,ui,message,    amazon-ebs: Transaction test succeeded
1623084997,,ui,message,    amazon-ebs: Running transaction
1623084997,,ui,message,    amazon-ebs:   Installing : tree-1.6.0-10.amzn2.0.1.x86_64                               1/1
1623084997,,ui,message,    amazon-ebs:   Verifying  : tree-1.6.0-10.amzn2.0.1.x86_64                               1/1
1623084997,,ui,message,    amazon-ebs:
1623084997,,ui,message,    amazon-ebs: Installed:
1623084997,,ui,message,    amazon-ebs:   tree.x86_64 0:1.6.0-10.amzn2.0.1
1623084997,,ui,message,    amazon-ebs:
1623084997,,ui,message,    amazon-ebs: Complete!
1623084997,,ui,say,==> amazon-ebs: Stopping the source instance...
1623084997,,ui,message,    amazon-ebs: Stopping instance
1623084998,,ui,say,==> amazon-ebs: Waiting for the instance to stop...
1623085013,,ui,say,==> amazon-ebs: Creating AMI AmazonLinux2-2021-06-07T16-55-59Z from instance i-002ca33d541534f99
1623085013,,ui,message,    amazon-ebs: AMI: ami-0b50d7d2aafa48580
1623085013,,ui,say,==> amazon-ebs: Waiting for AMI to become ready...
1623085195,,ui,say,==> amazon-ebs: Adding tags to AMI (ami-0b50d7d2aafa48580)...
1623085195,,ui,say,==> amazon-ebs: Tagging snapshot: snap-0cec58bfdd01d9530
1623085195,,ui,say,==> amazon-ebs: Creating AMI tags
1623085195,,ui,message,    amazon-ebs: Adding tag: \"Base_AMI_NAME\": \"amzn2-ami-hvm-2.0.20210427.0-x86_64-gp2\"
1623085195,,ui,message,    amazon-ebs: Adding tag: \"Base_AMI_ID\": \"ami-0ca38c7440de1749a\"
1623085195,,ui,say,==> amazon-ebs: Creating snapshot tags
1623085195,,ui,say,==> amazon-ebs: Terminating the source AWS instance...
1623085210,,ui,say,==> amazon-ebs: Cleaning up any extra volumes...
1623085211,,ui,say,==> amazon-ebs: No volumes to clean up%!(PACKER_COMMA) skipping
1623085211,,ui,say,==> amazon-ebs: Deleting temporary security group...
1623085211,,ui,say,==> amazon-ebs: Deleting temporary keypair...
1623085211,,ui,say,Build 'amazon-ebs' finished after 4 minutes 11 seconds.
1623085211,,ui,say,\
==> Wait completed after 4 minutes 11 seconds
1623085211,,ui,say,\
==> Builds finished. The artifacts of successful builds are:
1623085211,amazon-ebs,artifact-count,1
1623085211,amazon-ebs,artifact,0,builder-id,mitchellh.amazonebs
1623085211,amazon-ebs,artifact,0,id,ap-northeast-1:ami-0b50d7d2aafa48580
1623085211,amazon-ebs,artifact,0,string,AMIs were created:\
ap-northeast-1: ami-0b50d7d2aafa48580\

1623085211,amazon-ebs,artifact,0,files-count,0
1623085211,amazon-ebs,artifact,0,end
1623085211,,ui,say,--> amazon-ebs: AMIs were created:\
ap-northeast-1: ami-0b50d7d2aafa48580\

"

AWSTemplateFormatVersion: "2010-09-09"
Description: "Template to create sample IAM role to execute packer automation using SSM"
Parameters: 
  PackerTemplateS3BucketLocation: 
    Type: String
    Description: Enter the name of the bucket where the packer templates will be stored. This is used to add permissions to the policy. For example, my-packer-bucket
Resources:
    SSMAutomationPackerRole:
        Type: "AWS::IAM::Role"
        Properties:
            RoleName: "SSMAutomationPackerCF"
            ManagedPolicyArns: [
              'arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole'
            ]
            AssumeRolePolicyDocument: 
                Version: "2012-10-17"
                Statement: 
                  - 
                    Effect: "Allow"
                    Action: 
                      - "sts:AssumeRole"
                    Principal: 
                        Service: 
                          - "ec2.amazonaws.com"
                          - "ssm.amazonaws.com"

    SSMAutomationPackerInstanceProfile:
        Type: "AWS::IAM::InstanceProfile"
        Properties:
            InstanceProfileName: "SSMAutomationPackerCF"
            Roles:
              - !Ref SSMAutomationPackerRole

    SSMAutomationPackerInlinePolicy:
        Type: "AWS::IAM::Policy"
        Properties:
            PolicyName: "SSMAutomationPackerInline"
            PolicyDocument: 
                Version: "2012-10-17"
                Statement: 
                  - 
                    Effect: "Allow"
                    Action: 
                      - "iam:GetInstanceProfile"
                    Resource: 
                      - "arn:aws:iam::*:instance-profile/*"
                  - 
                    Effect: "Allow"
                    Action: 
                      - "logs:CreateLogStream"
                      - "logs:DescribeLogGroups"
                    Resource: 
                      - "arn:aws:logs:*:*:log-group:*"
                  - 
                    Effect: "Allow"
                    Action: 
                      - "s3:ListBucket"
                    Resource: 
                      - !Sub 'arn:aws:s3:::${PackerTemplateS3BucketLocation}'
                  - 
                    Effect: "Allow"
                    Action: 
                      - "s3:GetObject"
                    Resource: 
                      - !Sub 'arn:aws:s3:::${PackerTemplateS3BucketLocation}/*'
                  - 
                    Effect: "Allow"
                    Action: 
                      - "ec2:DescribeInstances"
                      - "ec2:CreateKeyPair"
                      - "ec2:DescribeRegions"
                      - "ec2:DescribeVolumes"
                      - "ec2:DescribeSubnets"
                      - "ec2:DeleteKeyPair"
                      - "ec2:DescribeSecurityGroups"
                    Resource: 
                      - "*"
            Roles: 
              - !Ref SSMAutomationPackerRole

    SSMAutomationPackerPassrolePolicy:
        Type: "AWS::IAM::Policy"
        Properties:
            PolicyName: "SSMAutomationPackerPassrole"
            PolicyDocument: 
                Version: "2012-10-17"
                Statement: 
                  - 
                    Sid: "SSMAutomationPackerPassrolePolicy"
                    Effect: "Allow"
                    Action: "iam:PassRole"
                    Resource: !GetAtt SSMAutomationPackerRole.Arn
            Roles: 
              - !Ref SSMAutomationPackerRole