True CI/CD Pipeline for "Golden Image" AMIs
Tags: actionshackathon, packer, ansible, terraform
Published: 2020-08-13 23:23:24

[Instructions]: # (To submit to the GitHub Actions x DEV Hackathon, please fill out all sections.)

From a comment on the announcement article:

> For this contest, you'll only be able to submit projects that you started after this announcement post was published.

Well, I guess I am disqualified. But, leaving this post up as a resource for anyone that may like it.

### My Workflow
[Note]: # (Make sure to include the name of your GitHub Action and share where it's being used!)

I have a process that creates custom AMIs as a "[golden image](https://opensource.com/article/19/7/what-golden-image)" and provisions infrastructure using Terraform for custom penetration testing resources in AWS. This workflow can be used for any type of image, however!

I leverage [Packer](https://www.packer.io/) with [Ansible](https://github.com/ansible/ansible) provisioners to build an EC2 image, then have Packer freeze that server into an AMI image. I use [Molecule](https://github.com/ansible-community/molecule) and Terraform Plan (using a free [Terraform Cloud](https://www.terraform.io/docs/cloud/index.html) account and Hashicorp's [Terraform GitHub Action](https://www.terraform.io/docs/github-actions/setup-terraform.html)) to test PRs. Merges to main trigger Packer builds that create a new AMI in my AWS account. [Terraform](https://www.terraform.io/) then runs and creates new infrastructure based off of the new AMI.

### Submission Category: 

DIY Deployments

[Note]: # (Maintainer Must-Haves, DIY Deployments, Interesting IoT, Phone Friendly, or Wacky Wildcards)


### Yaml File or Link to Code

[Note]: # (Our markdown editor supports pretty embeds. Try this syntax: `{% github link_to_your_repo %}` to share a GitHub repository)

The repo where this is all contained is:

{% github artis3n/cloud-hackbox %}

Let's step through the 2 workflows I use for this smooth CI/CD process.

#### CI

<https://github.com/artis3n/cloud-hackbox/blob/main/.github/workflows/ci.yml>

The CI workflow runs `molecule` to ensure any changes to the Ansible playbook for the AMI work and `terraform` to ensure any changes to that code results in the infrastructure that you expect. PRs must pass both checks before they can be merged.

#### CD

<https://github.com/artis3n/cloud-hackbox/blob/main/.github/workflows/build.yml>

In this workflow file, I build the new AMI with Packer and deploy it to my AWS account whenever new code is merged to main. I do not run Terraform afterward in this file because my use case is on-demand infrastructure in the future, but this can be accomplished with the following addition:

```yml
- name: Packer build
  run: packer build kali/kali-ami.json
  env:
      AWS_MAX_ATTEMPTS: 90
      AWS_POLL_DELAY_SECONDS: 60
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

# New steps

- uses: hashicorp/setup-terraform@v1
  with:
      cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

- name: Init
  run: cd kali/terraform && terraform init

- name: Provision
  run: cd kali/terraform && terraform apply -auto-approve
```

We can be confident about the `-auto-approve` as we have reviewed any changes in the plan during the PR review process.

### Additional Resources / Info

[Note]: # (Be sure to link to any open source projects that are using your workflow!)

[Note]: # (Be sure to include the DEV usernames of your collaborators, if any. )

[Reminder]: # (Submissions are due on September 12th (11:59 PM PDT) and winners will be announced on September 23!)