AWS Amazon EC2 AMI

aws_ami (Terraform)

The AMI in Amazon EC2 can be configured in Terraform with the resource name aws_ami. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

Checkmarx/kics

resource "aws_ami" "positive1" {
  name                = "terraform-example"
  virtualization_type = "hvm"
  root_device_name    = "/dev/xvda"

  ebs_block_device {

ffsclyh/config-lint

resource "aws_ami" "ebs_block_device_encrypted_set_to_true" {
  name = "foo"

  ebs_block_device {
    device_name = "/dev/xvda"
    volume_size = 8

ffsclyh/config-lint

resource "aws_ami" "ebs_block_device_encrypted_set_to_true" {
  name = "foo"

  ebs_block_device {
    device_name = var.test_device
    volume_size = var.test_volume

leonidweinbergcx/mykics

resource "aws_ami" "positive1" {
  name                = "terraform-example"
  virtualization_type = "hvm"
  root_device_name    = "/dev/xvda"

  ebs_block_device {

stelligent/config-lint

resource "aws_ami" "ebs_block_device_encrypted_set_to_true" {
  name = "foo"

  ebs_block_device {
    device_name = "/dev/xvda"
    volume_size = 8

Parameters

• architecture optional - string
• arn optional computed - string
• description optional - string
• ena_support optional - bool
• hypervisor optional computed - string
• id optional computed - string
• image_location optional computed - string
• image_owner_alias optional computed - string
• image_type optional computed - string
• kernel_id optional - string
• manage_ebs_snapshots optional computed - bool
• name required - string
• owner_id optional computed - string
• platform optional computed - string
• platform_details optional computed - string
• public optional computed - bool
• ramdisk_id optional - string
• root_device_name optional - string
• root_snapshot_id optional computed - string
• sriov_net_support optional - string
• tags optional - map from string to string
• usage_operation optional computed - string
• virtualization_type optional - string
• ebs_block_device set block
  • delete_on_termination optional - bool
  • device_name required - string
  • encrypted optional - bool
  • iops optional - number
  • snapshot_id optional - string
  • throughput optional computed - number
  • volume_size optional computed - number
  • volume_type optional - string
• ephemeral_block_device set block
  • device_name required - string
  • virtual_name required - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • update optional - string

Explanation in Terraform Registry

The AMI resource allows the creation and management of a completely-custom Amazon Machine Image (AMI). If you just want to duplicate an existing AMI, possibly copying it to another region, it's better to use aws_ami_copy instead. If you just want to share an existing AMI with another AWS account, it's better to use aws_ami_launch_permission instead.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_default_vpc

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_instance

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.