Packer config for provisioning AWS EBS AMIs

gistfile1.json

{
  "variables": {
    "vault_pass": "{{ env `VAULT_PASS` }}",
    "aws_access_key": "{{ env `AWS_ACCESS_KEY` }}",
    "aws_secret_key": "{{ env `AWS_SECRET_KEY` }}",
    "source_ami_id": "{{ env `SOURCE_AMI_ID` }}",
    "playbook": "{{ env `PLAYBOOK` }}",
    "ami_description": "{{ env `AMI_DESCRIPTION` }}",
    "roles_path": "{{ env `ROLES_PATH` }}"
  },

  "builders": [
	{
	  "type": "amazon-ebs",
	  "region": "us-west-2",
	  "source_ami": "{{ user `source_ami_id` }}",
	  "instance_type": "t2.micro",
	  "ssh_username": "ubuntu",
	  "ami_name": "main_ubuntu_image_1",
	  "vpc_id": "vpc-XXXXXX",
	  "subnet_id": "subnet-YYYYYYYY",
	  "access_key": "{{ user `aws_access_key` }}",
	  "secret_key": "{{ user `aws_secret_key` }}",
	  "security_group_id": "sg-ZZZZZZZ",
	  "ami_description": "{{ user `ami_description` }}",
	  "tags": {
		"OS": "Ubuntu",
		"PLAYBOOK": "{{ user `playbook` }}",
		"SOURCE_AMI_ID": "{{ user `source_ami_id` }}"
	  }
	}
  ],

  "provisioners": [
    { "type": "shell", "inline": ["sudo apt-get update && sudo apt-get install python-setuptools python-dev build-essential -y && sudo easy_install pip && sudo pip install --upgrade ansible"] },
    { "type": "file",  "source": "{{ user `roles_path` }}", "destination": "/tmp/ansible" },
    { "type": "shell", "inline": ["sudo mkdir -p /etc/ansible/roles && sudo mv /tmp/ansible/* /etc/ansible/roles"] },
    {
      "type": "ansible-local",
      "playbook_file": "{{ user `playbook` }}",
      "command": "echo '{{ user `vault_pass` }}' | ansible-playbook",
      "extra_arguments": "--vault-password-file=/bin/cat"
    },
    { "type": "shell", "inline": [ "sudo rm -rf /etc/ansible/roles" ] },
    { "type": "shell", "inline": [ "yes y | sudo pip uninstall ansible" ] }
  ]
}

Packer config for provisioning AWS EBS AMIs. Features:

1. Installs latest Ansible to AMI (or upgrades Ansible, if it is already exists)
2. Correctly passes AWS keys and Vault password as env variables.
3. Removes Ansible when provisioning is finished
4. It tags resulting AMI with source AMI id and with name and path of playbook used for provisioning.
5. AIM instance profiles are supported, too: just do not set AWS_ACCESS_KEY and AWS_SECRET_KEY env variables and Packer will try to authenticate using instance profile.

Example of how to launch this config from external shell script:

export AMI_DESCRIPTION="<DESCRIPTION>"
export VAULT_PASS=`<VAULT_PASS>`
export AWS_ACCESS_KEY="<AWS_ACCESS_KEY>"
export AWS_SECRET_KEY="<AWS_SECRET_KEY>"
export SOURCE_AMI_ID=`aws ec2 --region us-west-2 describe-images --filters Name=name,Values=<SOURCE_AMI_NAME> --query Images[*].ImageId --output text`
export PLAYBOOK="<PLAYBOOK>"
export ROLES_PATH="/etc/ansible-stuff/roles"

packer build packer.conf