-1

I have one AWS "infra" account that runs Image Builder to make nightly AMIs. These AMIs are shared with three other environment accounts (dev/stage/prod). These three accounts use the AMI in a Launch Template that backs an Auto Scaling group set to use the 'Latest' version of the template. All this is driven by Terraform.

Currently, I have no way of automatically recreating the Launch Template to point to the newest nightly AMI. I can run a refresh on the data.aws_ami resource, then apply on the targeted aws_launch_template resource. Automating this method inside AWS involves a lot of shared secrets and increased complexity. I've plotted out running Terraform in Lambda and deploying secrets for multiple accounts in the AMI account, and have determined it is not work or maintenance I want to do or hand off to anyone.

Ideally, I'd have some assume-role backed method: I would create an SSM parameter in each environment account and have the infra account update it via an event, but intra-account SSM sharing does not exist. Launch Templates created by Image Builder can't be shared across accounts, either.

Is there an elegant way to implement this automation, or am I stuck running Terraform via cron in Jenkins?

0

1 Answer 1

0

Part of the complexity that you are facing comes from the fact that you decided to separate the build and deployment stages across different platforms. If you had used Packer instead of image builder, you could have simply had one Jenkins pipeline for the Packer build, and a subsequent one for the Terraform deployment.

That said, considering the setup you already have in place, I would advise against implementing an AWS solution for this problem. If you were to adopt an AWS solution to resolve this, let's say a lambda that creates a new launch template referencing the freshly built image, then you would add complexity to your project and terraform would no longer be the single source of truth since the deployment of launch templates would happen outside of it.

Your setup is fine as it is and I think all you need is some plumbing.

or am I stuck running Terraform via cron in Jenkins?

I would recommend creating a lambda function which is triggered whenever a new image is built, and this lambda function could invoke the Jenkins pipeline via an API. This plumbing could and should be added to the terraform code you already have, perhaps in a separate module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.