使用Packer+AWS SSM构建GitHub Runner AMI时连接失败求助

环境信息 #

• Packer版本：1.11.2
• AWS Session Manager插件版本：1.2.650.0
• 源AMI：ubuntu-jammy-22.04-amd64-server-20240801（最新Ubuntu 22.04 LTS）
• Session Manager配置：禁用CloudWatch日志、S3日志及KMS加密

Packer模板配置（Amazon EBS构建器） #

source "amazon-ebs" "ubuntu" {
  ami_name         = "github-runner-ubuntu-jammy-amd64-${local.version_s}"
  instance_type    = "t3.medium"
  region           = "us-east-2"
  source_ami       = data.amazon-ami.ubuntu-2204.id
  ssh_username     = "ubuntu"
  ssh_interface    = "session_manager"
  pause_before_ssm = "3m"
  aws_polling {
    delay_seconds = 30
    max_attempts  = 50
  }
  temporary_iam_instance_profile_policy_document {
    Version = "2012-10-17"
    Statement {
      Effect = "Allow"
      Action = [
        "ssm:DescribeAssociation",
        "ssm:GetDeployablePatchSnapshotForInstance",
        "ssm:GetDocument",
        "ssm:DescribeDocument",
        "ssm:GetManifest",
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:ListAssociations",
        "ssm:ListInstanceAssociations",
        "ssm:PutInventory",
        "ssm:PutComplianceItems",
        "ssm:PutConfigurePackageResult",
        "ssm:UpdateAssociationStatus",
        "ssm:UpdateInstanceAssociationStatus",
        "ssm:UpdateInstanceInformation"
      ]
      Resource = ["*"]
    }
    Statement {
      Effect = "Allow"
      Action = [
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel"
      ]
      Resource = ["*"]
    }
    Statement {
      Effect = "Allow"
      Action = [
        "ec2messages:AcknowledgeMessage",
        "ec2messages:DeleteMessage",
        "ec2messages:FailMessage",
        "ec2messages:GetEndpoint",
        "ec2messages:GetMessages",
        "ec2messages:SendReply"
      ]
      Resource = ["*"]
    }
  }
  skip_create_ami = false
  deprecate_at    = local.deprecate_s
  tags = merge(
    var.global_tags,
    var.ami_tags,
    {
      OS_Version    = "ubuntu-jammy"
      Release       = "Latest"
      Base_AMI_Name = "{{ .SourceAMIName }}"
  })
  snapshot_tags = merge(
    var.global_tags,
    var.snapshot_tags,
  )

  launch_block_device_mappings {
    device_name           = "/dev/sda1"
    volume_size           = "15"
    volume_type           = "gp3"
    delete_on_termination = "true"
  }
}

执行命令 #

PACKER_LOG=1 packer build -debug -only *.amazon-ebs.* -var=ami_environment=test packer/ubuntu/packer.pkr.hcl

错误日志片段 #

==> github-runner-ubuntu.amazon-ebs.ubuntu: Attaching policy to the temporary role: packer-66bcc822-537d-ca74-a3aa-08fa262d2023
==> github-runner-ubuntu.amazon-ebs.ubuntu: Launching a source AWS instance...
    github-runner-ubuntu.amazon-ebs.ubuntu: Instance ID: i-0a358f5e6c0259ef2
==> github-runner-ubuntu.amazon-ebs.ubuntu: Waiting for instance (i-0a358f5e6c0259ef2) to become ready...
2024/08/14 11:25:06 packer-plugin-amazon_v1.3.2_x5.0_linux_amd64 plugin: 2024/08/14 11:25:06 [INFO] Not using winrm communicator, skipping get password...
==> github-runner-ubuntu.amazon-ebs.ubuntu: Waiting 3m0s before establishing the SSM session...
2024/08/14 11:28:07 packer-plugin-amazon_v1.3.2_x5.0_linux_amd64 plugin: 2024/08/14 11:28:07 Found available port: 8494 on IP: 0.0.0.0
2024/08/14 11:28:07 packer-plugin-amazon_v1.3.2_x5.0_linux_amd64 plugin: 2024/08/14 11:28:07 ssm: Starting PortForwarding session to instance i-0a358f5e6c0259ef2
==> github-runner-ubuntu.amazon-ebs.ubuntu: Using SSH communicator to connect: localhost
2024/08/14 11:29:16 packer-plugin-amazon_v1.3.2_x5.0_linux_amd64 plugin: 2024/08/14 11:29:16 [INFO] Waiting for SSH, up to timeout: 5m0s    
==> github-runner-ubuntu.amazon-ebs.ubuntu: Waiting for SSH to become available...
2024/08/14 11:29:16 packer-plugin-amazon_v1.3.2_x5.0_linux_amd64 plugin: 2024/08/14 11:29:16 [DEBUG] TCP connection to SSH ip/port failed: dial tcp 127.0.0.1:8494: connect: connection refused
... (many more connection refused errors)
2024/08/14 11:34:12 packer-plugin-amazon_v1.3.2_x5.0_linux_amd64 plugin: 2024/08/14 11:34:12 [DEBUG] TCP connection to SSH ip/port failed: dial tcp 127.0.0.1:8494: connect: connection refused
2024/08/14 11:34:16 packer-plugin-amazon_v1.3.2_x5.0_linux_amd64 plugin: 2024/08/14 11:34:16 [DEBUG] SSH wait cancelled. Exiting loop.
==> github-runner-ubuntu.amazon-ebs.ubuntu: Timeout waiting for SSH

已排查内容 #

• EC2实例创建成功，临时IAM实例配置文件已正确附加（策略匹配AmazonSSMManagedEC2InstanceDefaultPolicy）
• 安全组配置：无入站规则，出站全开放（符合SSM官方文档要求）
• 已尝试延长pause_before_ssm时长、给临时策略赋予全权限，问题未解决
• AWS控制台通过Session Manager连接实例时，直接提示“SSM Agent is not online”

疑问 #

是否是VPC/网络配置阻止了连接？是否仍需额外入站规则？或存在其他遗漏的配置项？

内容的提问来源于stack exchange，提问作者liteshade06