- EC2 Image Builder: Build your golden VM images on AWS - Wed, Jan 19 2022
- Configuring DFS Namespaces for Amazon FSx for Windows file servers - Fri, Jan 7 2022
- AWS Systems Manager Session Manager: Securely connect EC2 instances - Wed, Dec 22 2021
Create an image recipe
An image recipe is a document that defines the components to be applied to the base images to create the desired configuration for the output image. After a recipe has been created, it cannot be modified. A new version must be created to change the components.
To create a recipe, do the following:
Navigate to the EC2 Image Builder Console.
EC2 Image Builder console
Select Saved configurations > Image recipes.
Then click Create image recipe.
Image Recipe console
On the new screen, provide the following:
Recipe details—Under this section, specify a descriptive name, a recipe version in the format of major.minor.patch, and, optionally, a description for this recipe.
Recipe details
Base image—The starting point for image customization. In this section, select the image using one of the following methods:
- Managed Images—Images created by you, shared with you, or provided by AWS. This is the option we're using in this guide.
- Custom AMI ID—Pass the AMI ID and ensure that the AWS Systems Manager Agent (SSM Agent) is preinstalled in this AMI.
- Import base image—Import from your VM into Image Builder, and use the converted image as the base image in your recipe.
Then, you need to specify the image operating system. As of the time of this writing, Image Builder supports Amazon Linux, Windows, Ubuntu, CentOS, RHEL, and SLES. In this guide, we will use Windows.
Afterward, you need to choose the image origin from the following options:
- Quick start (Amazon-managed)—Amazon-curated images to help you get started
- Images owned by me—Images you created with Image Builder
- Images shared with me—Images shared with this account
Finally, you need to specify the Image name and Auto-versioning option, which is the OS version that the pipeline can automate for future builds.
Base image selection
Instance configuration—Under this section, specify the settings and scripts to run in addition to the components you choose for your image. In the User data section, configure an instance or run a configuration script during launch.
Configure the instance
Working directory—Under this section, specify the working directory for use during the build and test workflows.
Specify the working directory
Components—Components are software scripts that define the custom configuration of an image. Components cannot be modified or replaced after a recipe is created. Automatic version choices are provided for each component. A maximum of 20 components (including build and test) can be applied to a recipe.
The Components section comprises two steps:
Step 1: Choose build components to produce the desired output AMI—These are software scripts that define a sequence of steps for downloading, installing, and configuring software packages. They also define validation steps. You can select Amazon-managed build components, such as the Amazon CloudWatch agent, or you can create custom components.
Select build components
Step 2: (Optional) Select tests to verify the output AMI (post-build)—These are sequences of steps used to verify that the output image built by your image pipeline is functioning as expected. You can select Amazon-managed build components, such as testing a successful reboot after a build, or you can create custom components.
image8
Select test components
Note: Visit this link to learn more about creating customized build and test components.
Storage (Volumes)—The root volume's device name, snapshot, and IOPS selections are not editable. However, you can change all the remaining settings, such as size. You can also add new volumes.
Specify storage device settings
Tags—Assign metadata to your recipe resource.
Finally, click Create recipe.
Create infrastructure configurations
Infrastructure configurations specify infrastructure details for the instances that will run from the golden image we're creating.
To create an infrastructure configuration, do the following:
Navigate to the Infrastructure configurations section in the EC2 Image Builder console.
Click Create infrastructure configuration.
Infrastructure Configuration Console
On the new screen, specify the following:
General—Under this section, specify the following:
- Name—Provide a descriptive name.
- Description—Provide a description for the infrastructure configuration we're creating (optional).
- IAM role—Select a role to associate with the instance profile. This role defines what permissions the instances launched by EC2 Image Builder will have in your account. These permissions are used to download and execute your components, upload logs to CloudWatch, and perform any additional actions specified in your selected components.
Note: Ensure you've created an IAM role with the needed permissions before creating the infrastructure configuration.
General infrastructure configurations
AWS infrastructure—In this section, specify the following:
- Instance type—Select one or more instance types to customize your image.
- SNS topic—Select an SNS topic to receive notifications and alerts from the EC2 Image Builder.
Note—Ensure that you have an SNS topic already created before creating the infrastructure configurations.
- VPC—Specify the VPC, the subnet within the VPC, and the security groups.
- Troubleshooting settings—Specify settings to troubleshoot issues with building your image, such as whether to terminate your instance upon failure, a key pair to attach to the instance, and where to save the logs.
Specify AWS infrastructure settings
Infrastructure tags—Assign metadata to the EC2 instance created during the build process.
Tags—Assign metadata to your infrastructure configuration resource.
Finally, click Create Infrastructure Configuration.
Create distribution settings
Distribution settings include specific regional settings for encryption, launch permissions, accounts that can launch the output AMI, the output AMI name, and license configurations.
To create a distribution setting, do the following:
Navigate to the Distribution settings section in the EC2 image Builder console.
Click Create distribution settings.
Distribution settings console
On the new screen, specify the following:
Image type—Select the image output type, either an AMI or a Docker image.
Specify image type
General—Specify a descriptive name and, optionally, add a description.
Region settings—The default region is displayed as Region 1 in the Region settings. Some settings for the default region are not open for editing. To add more regions for distribution, click Add Region. You can also publish the AMI to other AWS accounts by specifying target accounts, but you must create the EC2ImageBuilderDistributionCrossAccountRole role in all of the target accounts in the target regions and attach the Ec2ImageBuilderCrossAccountDistributionAccess managed policy to the role.
You can specify an Output AMI name, where the final output name is the provided name suffixed with a timestamp of when the AMI was built. If you do not specify a name, EC2 Image Builder appends the build timestamp to the recipe name. This ensures unique AMI names for each build.
You can grant access to specified AWS principals (AWS accounts, organizations, and organizational units) to launch instances from your AMI via AMI Sharing.
If you want to attach license configurations, a construct of AWS License Manager, to images built with Image Builder, license configurations contain licensing rules based on the terms of your enterprise agreements. Image Builder inherits license configurations associated with your AMI.
If you are using an EC2 launch template, you can instruct EC2 Image Builder to create a new version of your launch template that includes the latest AMI ID after the build completes.
Specify region settings
Output AMI tags—Assign metadata to your output AMI. The specified tags are applied to all selected regions.
Tags—Assign metadata to your distribution settings resource.
Finally, click Create settings.
Create an image pipeline
The image pipeline defines all aspects of the process of customizing images. It comprises the image recipe, infrastructure configuration, distribution, and test settings.
To create an image pipeline, do the following:
Navigate to the Image pipelines section in the EC2 image Builder console.
Click Create image pipeline.
Image Pipelines console
On the new screen, specify the following pipeline details:
General—Specify a descriptive name and, optionally, add a description.
Specify pipeline details
Build Schedule—You can schedule your pipeline job to run automatically using the Schedule builder or a cron expression, or you can run your job manually.
image18
Configure pipeline scheduler options
Tags—Assign metadata to your distribution settings resource.
Then click Next.
On the next screen, choose a recipe. Select the recipe created earlier.
On the next screen, define the infrastructure configuration. Select the infrastructure configuration created earlier.
On the next screen, define the distribution settings. Select the distribution settings created earlier.
On the next screen, review your configuration, and then click Create pipeline.
Conclusion
In this article, we've reviewed how to build your golden VM images on AWS using EC2 Image Builder. If you have any further questions, please mention them in the comments.
Subscribe to 4sysops newsletter!
DISCLAIMER: This article represents my own viewpoints, not those of my employer, Amazon Web Services.
