如何通过Terraform跨账号复制Packer创建的AWS AMI并保留标签？

前提条件 #

• 源AMI位于孟买区域（ap-south-1），所属账号需授权目标账号拥有该AMI的复制权限
• 目标账号需配置Terraform AWS Provider，有权限在海德拉巴区域（ap-south-2）创建AMI

步骤1：源账号授权目标账号复制AMI #

在源账号的Terraform配置中，添加以下资源为目标账号授予复制权限：

resource "aws_ami_permission" "allow_cross_account_copy" {
  image_id   = "ami-xxxxxxxxx"  # 替换为你的源AMI ID
  account_id = "123456789012"   # 替换为目标AWS账号ID
  actions    = ["copy"]
}

步骤2：目标账号配置AMI复制并保留原标签 #

在目标账号的Terraform配置中，先通过数据源获取源AMI的标签信息，再执行复制操作并复用原标签：

# 获取源AMI的元数据（包括标签）
data "aws_ami" "source_mumbai_ami" {
  owners      = ["987654321098"]  # 替换为源AWS账号ID
  most_recent = true

  filter {
    name   = "image-id"
    values = ["ami-xxxxxxxxx"]     # 替换为源AMI ID
  }
}

# 复制AMI到ap-south-2区域，保留原标签并添加自定义标签
resource "aws_ami_copy" "to_hyderabad" {
  name              = "${data.aws_ami.source_mumbai_ami.name}-copied-ap-south-2"
  description       = "Cross-account copy of ${data.aws_ami.source_mumbai_ami.id} from ap-south-1"
  source_ami_id     = data.aws_ami.source_mumbai_ami.id
  source_ami_region = "ap-south-1"
  target_region     = "ap-south-2"

  # 合并原标签与自定义标签，保留所有源标签
  tags = merge(
    data.aws_ami.source_mumbai_ami.tags,
    {
      "Copied-From-Region" = "ap-south-1"
      "Copy-Timestamp"     = timestamp()
    }
  )
}

关键说明 #

• 使用data "aws_ami"可以自动拉取源AMI的所有标签，无需手动重复配置
• merge函数将源标签与新增的自定义标签合并，确保原标签完整保留
• 如果仅需共享AMI（不复制），可将源账号的aws_ami_permission中actions改为["describe", "launch"]，但复制后的AMI独立于源AMI，更适合长期使用

内容的提问来源于stack exchange，提问作者Satyam Pandey