I have one AWS "infra" account that runs Image Builder to make nightly AMIs. These AMIs are shared with three other environment accounts (dev/stage/prod). These three accounts use the AMI in a Launch Template that backs an Auto Scaling group set to use the 'Latest' version of the template. All this is driven by Terraform.
Currently, I have no way of automatically recreating the Launch Template to point to the newest nightly AMI. I can run a refresh on the data.aws_ami resource, then apply on the targeted aws_launch_template resource. Automating this method inside AWS involves a lot of shared secrets and increased complexity. I've plotted out running Terraform in Lambda and deploying secrets for multiple accounts in the AMI account, and have determined it is not work or maintenance I want to do or hand off to anyone.
Ideally, I'd have some assume-role backed method: I would create an SSM parameter in each environment account and have the infra account update it via an event, but intra-account SSM sharing does not exist. Launch Templates created by Image Builder can't be shared across accounts, either.
Is there an elegant way to implement this automation, or am I stuck running Terraform via cron in Jenkins?