3 ms·

Actually, AWS does now support building AMIs and sharing it across an AWS Organization or OU: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-amis-wit

by twunde 4y ago

Actually, AWS does now support building AMIs and sharing it across an AWS Organization or OU: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-amis-with-organizations-and-OUs.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-am.... If you're using Packer you want ami_org_arns to share with an org or ami_ou_arns to share with OUs https://www.packer.io/plugins/builders/amazon/ebs#ami_org_arns https://www.packer.io/plugins/builders/amazon/ebs#ami_org_ar.... You do still need to create separate AMIs per region though

cutthegrass2 4y ago
This is great, thanks for your post. Is a cross-region copy and a re-share better than rebuilding the AMI in the new region I wonder? Penny for your thoughts?
- verdverm 4y ago
  Gonna depend on what you put in your AMI (how much / timing) and whether you have access to everything you need. Also, does your automation that drives packer (should?) have access to the other accounts.
- twunde 4y ago
  Assuming that you're not hardcoding anything region-specific, a copy is likely going to be the preferred method since this way you know that the AMIs are the same (ie there's no way that a dependency updated). However there are two complicating factors that may persuade you the other way. Check the cost of cross-region data transfer vs the cost of building your AMI. If your AMI is particularly large, it may make more financial sense to just rebuild the AMI. The other complicating factor is encryption. You _can_ copy an encrypted AMI per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html#ami-copy-encryption https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingA..., although perms can be a bit finicky. If you're encrypting something with a region-specific Vault or a HSM, then you'll likely need to rebuild the AMI

3 ms·

Actually, AWS does now support building AMIs and sharing it across an AWS Organization or OU: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-amis-wit

by twunde 4y ago

cutthegrass2 4y ago
This is great, thanks for your post. Is a cross-region copy and a re-share better than rebuilding the AMI in the new region I wonder? Penny for your thoughts?
- verdverm 4y ago
  Gonna depend on what you put in your AMI (how much / timing) and whether you have access to everything you need. Also, does your automation that drives packer (should?) have access to the other accounts.
- twunde 4y ago
  Assuming that you're not hardcoding anything region-specific, a copy is likely going to be the preferred method since this way you know that the AMIs are the same (ie there's no way that a dependency updated). However there are two complicating factors that may persuade you the other way. Check the cost of cross-region data transfer vs the cost of building your AMI. If your AMI is particularly large, it may make more financial sense to just rebuild the AMI. The other complicating factor is encryption. You _can_ copy an encrypted AMI per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html#ami-copy-encryption https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingA..., although perms can be a bit finicky. If you're encrypting something with a region-specific Vault or a HSM, then you'll likely need to rebuild the AMI