使用GitHub Actions+Packer创建EC2 AMI时遇session-manager-plugin缺失错误

手动在EC2控制台可正常建立会话，但使用HashiCorp Packer结合GitHub Actions构建AWS EC2 AMI时，执行过程反复抛出以下错误，最终导致SSH连接超时：

==> learn-packer.amazon-ebs.ubuntu: exec: "session-manager-plugin": executable file not found in $PATH
    learn-packer.amazon-ebs.ubuntu: Starting portForwarding session "Amy-0828c24ed1832".
==> learn-packer.amazon-ebs.ubuntu: exec: "session-manager-plugin": executable file not found in $PATH
    learn-packer.amazon-ebs.ubuntu: Starting portForwarding session "Amy-0623f28d5baf5".
==> learn-packer.amazon-ebs.ubuntu: exec: "session-manager-plugin": executable file not found in $PATH
    learn-packer.amazon-ebs.ubuntu: Starting portForwarding session "Amy-0f8f333dd2b90".
==> learn-packer.amazon-ebs.ubuntu: exec: "session-manager-plugin": executable file not found in $PATH
    learn-packer.amazon-ebs.ubuntu: Starting portForwarding session "Amy-0b5c2a4bf4f2a".
==> learn-packer.amazon-ebs.ubuntu: exec: "session-manager-plugin": executable file not found in $PATH
==> learn-packer.amazon-ebs.ubuntu: Timeout waiting for SSH.

相关配置 #

GitHub Actions工作流配置

name: AWS AMI Build

on:
  # schedule:
  #   - cron: '0 4 * * *'
  push:
    branches:
      - main
  workflow_dispatch:

env:
  PRODUCT_VERSION: "1.8.6" # or: "latest"

jobs:
  packer:
    runs-on: ["self-hosted"]
    name: packer
    defaults:
      run:
        working-directory: packer
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v2
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
          aws-region: us-east-1

      - name: Setup `packer`
        uses: hashicorp/setup-packer@main
        id: setup
        with:
          version: "1.8.6" # or `latest`

      - name: Run `packer init`
        id: init
        run: "packer init ./image.pkr.hcl"

      - name: Run `packer validate`
        id: validate
        run: "packer validate ./image.pkr.hcl"


      - name: Packer Build
        run: packer build -color=false -on-error=cleanup -debug ../packer/image.pkr.hcl

Packer配置

packer {
  required_plugins {
    amazon = {
      version = ">= 1.1.1"
      source = "github.com/hashicorp/amazon"
    }
  }
}

variable "skip_create_ami" {
  type = string
  default = "true"
}

locals {
  timestamp = formatdate("YYYYMMDDHHmmss", timestamp())
  ami_name = "sample-ami-cdc-${local.timestamp}"
}

source "amazon-ebs" "ubuntu" {
  ami_name = local.ami_name
  instance_type = "c5.large"
  region = "us-east-1"
  source_ami = "ami-08a52ddb321b32a8c"
  
  temporary_iam_instance_profile_policy_document {
    Version = "2012-10-17"
    Statement {
      Effect = "Allow"
      Action = [
        "ssm:DescribeAssociation",
        "ssm:GetDeployablePatchSnapshotForInstance",
        "ssm:GetDocument",
        "ssm:DescribeDocument",
        "ssm:GetManifest",
        "ssm:StartSession",
        "ssm:GetParameter",
        "ssm:TerminateSession",
        "ssm:GetParameters",
        "ssm:ListAssociations",
        "ssm:ListInstanceAssociations",
        "ssm:PutInventory",
        "ssm:PutComplianceItems",
        "ssm:PutConfigurePackageResult",
        "ssm:UpdateAssociationStatus",
        "ssm:UpdateInstanceAssociationStatus",
        "ssm:UpdateInstanceInformation"
      ]
      Resource = [
        "*"]
    }
    Statement {
      Effect = "Allow"
      Action = [
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel"
      ]
      Resource = [
        "*"]
    }
    Statement {
      Effect = "Allow"
      Action = [
        "ec2messages:AcknowledgeMessage",
        "ec2messages:DeleteMessage",
        "ec2messages:FailMessage",
        "ec2messages:GetEndpoint",
        "ec2messages:GetMessages",
        "ec2messages:SendReply"
      ]
      Resource = [
        "*"]
    }
  }


  subnet_filter {
    filters = {
      "tag:Name" : "my-hello-*"
    }
    most_free = true
    random = true
  }

  security_group_filter {
    filters = {
      "tag:Name": "hello-QA3-*"
    }
  }
  associate_public_ip_address = true

  communicator = "ssh"
  ssh_username = "ec2-user"
  ssh_interface = "session_manager"

  skip_create_ami = false
  # "${var.skip_create_ami}"


}
build {
  name = "learn-packer"
  sources = [
    "source.amazon-ebs.ubuntu"
  ]
}

解决方案 #

在GitHub Actions工作流中添加安装AWS CLI和Session Manager插件的步骤即可解决该问题。示例步骤如下：

- name: Install AWS CLI and Session Manager Plugin
  run: |
    sudo apt-get update
    sudo apt-get install -y awscli
    curl "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_64bit/session-manager-plugin.deb" -o "session-manager-plugin.deb"
    sudo dpkg -i session-manager-plugin.deb

将该步骤插入到Configure AWS Credentials和Setup packer步骤之间即可。

内容的提问来源于stack exchange，提问作者Messmer