AWS Amazon EC2 Copy

aws_ami_copy (Terraform)

The Copy in Amazon EC2 can be configured in Terraform with the resource name aws_ami_copy. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

ffsclyh/config-lint

resource "aws_ami_copy" "encrypted_set_to_true" {
  name              = "foo"
  source_ami_id     = "ami-xxxxxxxx"
  source_ami_region = "us-east-1"
  encrypted         = true
}

ffsclyh/config-lint

resource "aws_ami_copy" "encrypted_set_to_true" {
  name              = "foo"
  source_ami_id     = var.test_ami
  source_ami_region = var.test_region
  encrypted         = true
}

stelligent/config-lint

resource "aws_ami_copy" "encrypted_set_to_true" {
  name              = "foo"
  source_ami_id     = "ami-xxxxxxxx"
  source_ami_region = "us-east-1"
  encrypted         = true
}

stelligent/config-lint

resource "aws_ami_copy" "encrypted_set_to_true" {
  name              = "foo"
  source_ami_id     = var.test_ami
  source_ami_region = var.test_region
  encrypted         = true
}

Kanshar/aws-exercise

resource "aws_ami_copy" "web_ami_copy" {
  name              = "web-ami-copy"
  source_ami_id     = var.server_ami
  source_ami_region = var.region

  tags = {

Parameters

• architecture optional computed - string
• arn optional computed - string
• description optional - string
• ena_support optional computed - bool
• encrypted optional - bool
• hypervisor optional computed - string
• id optional computed - string
• image_location optional computed - string
• image_owner_alias optional computed - string
• image_type optional computed - string
• kernel_id optional computed - string
• kms_key_id optional computed - string
• manage_ebs_snapshots optional computed - bool
• name required - string
• owner_id optional computed - string
• platform optional computed - string
• platform_details optional computed - string
• public optional computed - bool
• ramdisk_id optional computed - string
• root_device_name optional computed - string
• root_snapshot_id optional computed - string
• source_ami_id required - string
• source_ami_region required - string
• sriov_net_support optional computed - string
• tags optional - map from string to string
• usage_operation optional computed - string
• virtualization_type optional computed - string
• ebs_block_device set block
  • delete_on_termination optional computed - bool
  • device_name optional computed - string
  • encrypted optional computed - bool
  • iops optional computed - number
  • snapshot_id optional computed - string
  • throughput optional computed - number
  • volume_size optional computed - number
  • volume_type optional computed - string
• ephemeral_block_device set block
  • device_name optional computed - string
  • virtual_name optional computed - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • update optional - string

Explanation in Terraform Registry

The "AMI copy" resource allows duplication of an Amazon Machine Image (AMI), including cross-region copies. If the source AMI has associated EBS snapshots, those will also be duplicated along with the AMI. This is useful for taking a single AMI provisioned in one region and making it available in another for a multi-region deployment. Copying an AMI can take several minutes. The creation of this resource will block until the new AMI is available for use on new instances.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_default_vpc

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_instance

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.