forked from thilinaba/aws-cis-ami
-
Notifications
You must be signed in to change notification settings - Fork 0
/
cis-ami.pkr.hcl
100 lines (80 loc) · 2.12 KB
/
cis-ami.pkr.hcl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# This will build a CIS Level 1 hardened AMI from Amazon Linux 2 base AMI
# Validate the template
# eg: packer validate cis-ami.pkr.hcl
# Set the correct variables in the variables.json file
# A sample build command would look like this
# packer build -var-file=variables.json cis-ami.pkr.hcl
# If you don't set the profile variable as above, it will take the following as default
variable "profile" {
type = string
default = "default"
}
# Use the Amazon Linux 2 (latest) AMI as the source_ami
variable "source_ami" {
type = string
}
variable "region" {
type = string
}
variable "vpc_id" {
type = string
}
variable "subnet_id" {
type = string
}
variable "instance_type" {
type = string
default = "t3.micro"
}
variable "ami_name_prefix" {
type = string
default = "cis-hardened-aws-ami"
}
# Use the Amazon Linux 2 (latest) AMI as the source_ami
locals {
timestamp = regex_replace(timestamp(), "[- TZ:]", "")
standard_tags = {
BaseOS = "Amazon Linux 2"
}
}
# Set the VPC and Subnet to somewhat which has Internet accesss (Could be any public subnet)
# Packer will take care of the rest
source "amazon-ebs" "cis-ami" {
profile = "${var.profile}"
ami_name = "${var.ami_name_prefix}-${local.timestamp}"
instance_type = "${var.instance_type}"
region = "${var.region}"
vpc_id = "${var.vpc_id}"
subnet_id = "${var.subnet_id}"
associate_public_ip_address = "true"
// Amazon Linux 2 AMI ID
source_ami = "${var.source_ami}"
ssh_username = "ec2-user"
// Set the AMI's Name tag with timestamp
tag {
key = "Name"
value = "${var.ami_name_prefix}-${local.timestamp}"
}
// Set the default tags for the AMI
dynamic "tag" {
for_each = local.standard_tags
content {
key = tag.key
value = tag.value
}
}
}
# Building the Puppet Server AMI
build {
sources = ["source.amazon-ebs.cis-ami"]
provisioner "file"{
source = "./files"
destination = "/tmp"
}
provisioner "shell" {
script = "./scripts/hardening.sh"
}
provisioner "shell" {
script = "./scripts/install.sh"
}
}