Packer

HashiCorp Packer automates the generation of identical machine images across multiple cloud providers and hypervisors from a single declarative HCL configuration.

When to Use

• Automated Golden Image Creation: Building standardized, hardened virtual machine images across AWS AMIs, Azure VMs, and GCP.
• Immutable Infrastructure Pipelines: Pre-baking operating systems, security patches, and application runtimes into images.
• Multi-Cloud Image Synchronization: Generating identical VM images for multiple clouds from a single HCL template.
• Compliance & Security Hardening: Running CIS benchmark Ansible playbooks during image build pipelines.

Quick Start

source "amazon-ebs" "ubuntu" {
  ami_name      = "my-app-{{timestamp}}"
  instance_type = "t3.micro"
  region        = "us-west-2"
  source_ami_filter {
    filters = {
      name                = "ubuntu/images/*ubuntu-jammy-22.04-amd64-server-*"
      root-device-type    = "ebs"
      virtualization-type = "hvm"
    }
    most_recent = true
    owners      = ["099720109477"] # Canonical
  }
  ssh_username = "ubuntu"
}

build {
  sources = ["source.amazon-ebs.ubuntu"]

  provisioner "shell" {
    inline = ["sudo apt-get update", "sudo apt-get install -y nginx"]
  }
}

Core Concepts

Modern HCL2 Template for AWS Golden AMI

Building an encrypted, hardened Ubuntu AMI:

# ubuntu_ami.pkr.hcl
packer {
  required_plugins {
    amazon = {
      version = ">= 1.2.8"
      source  = "github.com/hashicorp/amazon"
    }
  }
}

variable "aws_region" {
  type    = string
  default = "us-east-1"
}

source "amazon-ebs" "hardened_ubuntu" {
  ami_name      = "golden-ubuntu-24-04-{{timestamp}}"
  instance_type = "t3.medium"
  region        = var.aws_region
  encrypt_boot  = true

  source_ami_filter {
    filters = {
      name                = "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"
      root-device-type    = "ebs"
      virtualization-type = "hvm"
    }
    most_recent = true
    owners      = ["099720109477"] # Canonical
  }

  ssh_username = "ubuntu"
  tags = {
    OS          = "Ubuntu 24.04"
    Environment = "Golden-Images"
    BuildTime   = "{{timestamp}}"
  }
}

build {
  sources = ["source.amazon-ebs.hardened_ubuntu"]

  # Step 1: Update and install security packages
  provisioner "shell" {
    inline = [
      "sudo apt-get update",
      "sudo apt-get upgrade -y",
      "sudo apt-get install -y fail2ban ufw unattended-upgrades"
    ]
  }

  # Step 2: Apply Ansible hardening playbook
  provisioner "ansible" {
    playbook_file = "./playbooks/cis_hardening.yml"
  }
}

Validating, Formatting and Building Images

Executing Packer CLI build workflow:

# Format template
packer fmt ubuntu_ami.pkr.hcl

# Validate template syntax and credentials
packer validate ubuntu_ami.pkr.hcl

# Build golden AMI with variable override
packer build -var "aws_region=us-east-1" ubuntu_ami.pkr.hcl

Common Patterns

Automated AWS AMI Builder with Shell Provisioning

Problem: Manual server hardening creates configuration drift and slow auto-scaling boot times.

Solution: Build pre-baked immutable AMIs with Packer HCL2:

packer {
  required_plugins {
    amazon = {
      version = ">= 1.2.0"
      source  = "github.com/hashicorp/amazon"
    }
  }
}

source "amazon-ebs" "ubuntu" {
  ami_name      = "hardened-ubuntu-24-04-{{timestamp}}"
  instance_type = "t3.small"
  region        = "us-east-1"
  source_ami_filter {
    filters = {
      name                = "ubuntu/images/hvm-ssd/ubuntu-noble-24.04-amd64-server-*"
      root-device-type    = "ebs"
      virtualization-type = "hvm"
    }
    most_recent = true
    owners      = ["099720109477"]
  }
  ssh_username = "ubuntu"
}

build {
  sources = ["source.amazon-ebs.ubuntu"]
  provisioner "shell" {
    inline = [
      "sudo apt-get update",
      "sudo apt-get install -y docker.io nginx",
      "sudo systemctl enable docker"
    ]
  }
}

Best Practices

Do:

• Target modern HCL2 templates (.pkr.hcl) instead of legacy deprecated JSON Packer templates.
• Set encrypt_boot = true on EBS volumes to ensure golden images are encrypted at rest with KMS.
• Use source_ami_filter with most_recent = true and official owner IDs to build on verified vendor base images.
• Clean up temporary shell history and SSH host keys before the image is finalized.

Don't:

• Bake sensitive production secrets or private API tokens into golden images; inject secrets at runtime.
• Leave default administrative passwords set in base images.
• Run Packer without packer validate in continuous integration builds.

Troubleshooting

| Error | Cause | Solution | | :-------------------------------------------------- | :-------------------------------------------------------------------------------- | :------------------------------------------------------------- | | Error: Timeout waiting for SSH | Security group blocks port 22 or SSH key pair mismatch during build. | Verify subnet has public IP assignment and allows inbound SSH. | | Failed to initialize plugins | Required plugin not installed on host. | Run packer init <config.pkr.hcl> before executing build. | | Amazon Elastic Block Store: UnauthorizedOperation | IAM role running Packer lacks permissions to create EC2 keys, instances, or AMIs. | Grant required EC2 permissions in AWS IAM policy. |

References

• Packer Documentation