加壳安全组查询

Question

I want to restrict all the team members to use a specific group (SG_TS) while creating an AWS Ec2 instance from AMI build using Packer. Is there any way to do so using Packer?

While creating an AMI from Packerin Packers Builders section, I am giving security group as mentioned below:

"security_group_id":"xxxxxxxx"

But I think above security group ID will be used for SSH by the packer. When I create an EC2 instance from the BUILD AMI, it's asking again for the Security group while configuring Ec2 instance. It's not picking the security group defined in AMI.

Please let me know how this can be implemented?

Answer 1

When users launch an instance from AMI, they control security groups and other related parameters.

If you want to restrict their control, wrap instance creation process in Cloudformation template (hardcode SG ID there), or create service catalog product (which is one step more involved than CF template, but allows for more granular access control).

Also, you might want to remove SG ID from your question, since this is not something any third party should know.