Unable to use ami_regions when Tags-on-create policy enforced

[a1exx-k]

Overview of the Issue

Our organization enforces an AWS Organizations tag policy (“Tags-on-create” enforcement) that requires some tags at the moment the AMI is created in the destination region.

When Packer uses ami_regions to copy an AMI, it seems that tags aren’t supplied as TagSpecifications in that copy request, and the call is rejected before any post-copy tagging can occur — which yields this error:

TagPolicyViolation: The resource is missing the tag key(s) 'RequiredTag'

Therefore, we are unable to use ami_regions option.

Reproduction Steps

Steps to reproduce this issue

• Introduce “Tags-on-create” enforcement policy in AWS in target region with tag RequiredTag
• Add RequiredTag tag to tags list
• Set ami_regions to target region
• AMI copy fails with TagPolicyViolation: The resource is missing the tag key(s) 'RequiredTag'

Plugin and Packer version

packer v1.13.0, plugin v1.3.9

Simplified Packer Buildfile

source "amazon-ebs" "example" {
  ami_name          = "example"
  region = ["eu-central-1"]
  ami_regions  = ["eu-west-1"]
  ...
  run_tags = {
    RequiredTag  = "value"
  }
  snapshot_tags = {
    RequiredTag  = "value"
  }

  tags = {
    RequiredTag  = "value"
  }
  ...
}

build {
  sources = ["source.amazon-ebs.sample"]
}

Operating system and Environment details

linux, amd64

[macropin]

This might be the same bug we've encountered with Packer v1.14.2, and plugin v1.7.0. The AMI copied to regions is tagged correctly, but the associated snapshot has no tags.

[a1exx-k]

Packer v1.14.2, and plugin v1.7.0 issue is still present

[macropin]

@a1exx-k I'm not sure if your issue is related to tags on the AMI or snapshot. But in the case of the snapshot missing tags, it seems common/step_ami_region_copy.go is using the AWS CopyImage API which does not apply tags to the corresponding AMI snapshot unless TagSpecification is passed. In other words setting CopyImageTags is not sufficient to apply tags to the AMI associated snapshot.

So the fix here would be to set a TagSpecification that corresponds to whichever set of tags should be on the snapshot.

[a1exx-k]

@macropin this is very correct - our current workaround is to use shell post-provisioner with aws cli:

aws ec2 copy-image ... --tag-specifications 'ResourceType=image,Tags=[ array of tags ]' --copy-image-tags