PR #296 requires ec2-instance-connect:SendSSHPublicKey even if you're not specifying a private key

[jacobappleton-orbis]

Overview of the Issue

PR #296 says that "If the user does not specify a private key, then works like the previous implementation."

We are not specifying a private key, but our Packer builds are now failing because the IAM policy of the role running Packer doesn't have ec2-instance-connect:SendSSHPublicKey permissions.

The only parameters we're specifying are ssh_username="ubuntu" and ssh_interface="session_manager".

Plugin and Packer version

Plugin version is github.com/hashicorp/amazon v1.2.0

[kasperbrandenburg-schibsted]

Had this issue .. fixed temporarily by pinning the version

packer {
  required_plugins {
    amazon = {
      version = "= 1.1.6"
      source  = "github.com/hashicorp/amazon"
    }
  }
}

[Glyphack]

This is because the key pair created on AWS can also set the SSHPublicKey value.

We can limit this to when the key upload to only when user sets value of SSHPrivateKeyFile.

I can send a patch for this. @lbajolet-hashicorp What do you think?

[lbajolet-hashicorp]

Hi @Glyphack,

Regarding the step you're referencing from the SDK, it's never used in the Amazon plugin, so that should be unrelated to this code.

The private key is set however through the StepKeyPair that is specific to this plugin (SEE: https://github.com/hashicorp/packer-plugin-amazon/blob/main/builder/common/step_key_pair.go#L103), we can probably amend the condition as you point out to only trigger an upload when the SSHKeyPairName is not set, as this is only present when we're using the temporary key pair.

If you want to patch this feel free to open a PR, I can do it otherwise, as you prefer!

[Glyphack]

Thanks for the clarification. Will send the patch in few hours.

[lbajolet-hashicorp]

Hi,

Regarding this issue, the PR mentioned in here has been merged, and version 1.2.1 of the plugin was released today, which should fix the problem you've been encountering.

Apologies for the buggy release.