Golden Image Factory
Bake a hardened parent AMI, wait until it is available, bake a child app AMI from that parent with unsigned provenance, wire local CI and channels.json, then clean up both AMIs and snapshots.
Lab Overview
This is the hands-on lab for Section 13 of Packer 101. You operate a thin parent/child golden-image factory on AWS without HCP Packer and without ansible-local. The parent bake hardens SSH password auth, sets both IMDSv2 knobs, and drops a marker file. After the parent AMI reaches state available, the child bake starts from that AMI id, proves the parent marker still exists, and emits a manifest plus unsigned Packer 1.16 provenance (signing_mode = "none"). You then write a local build.sh and a GitHub Actions workflow file (not executed on GitHub) and maintain a channels.json analog for HCP channels. Cleanup deregisters both AMIs and deletes their snapshots.
You will:
- Confirm Packer 1.16.0 and AWS credentials on the lab host
- Bake a parent hardened AMI on t2.micro with shell-only provisioners
- Wait for the parent AMI to become available, then bake a unique child AMI
- Attach unsigned provenance, write build.sh and a workflow YAML, and update
channels.json from manifests
- Deregister both AMIs and delete both EBS snapshots
What You'll Learn
Confirm Packer 1.16.0 and AWS identity on the packer-host lab VM
Bake a thin hardened parent AMI with sshd, IMDSv2, and a marker file
Wait for parent AMI available, then bake a child AMI from source_ami
Emit signing_mode none provenance and local CI/channels analogs
Deregister both AMIs and delete both EBS snapshots
Prerequisites
Completion of the Packer 101 Section 13 lessons on CI/CD and golden factories
Familiarity with amazon-ebs builds from earlier Packer 101 labs
Basic Linux command line (bash, jq, reading logs)
Technologies Covered
Part of a Course
This lab is part of the Packer 101 — Golden Images for AWS, Azure, and GCP course
View All CoursesChoose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Self-paced bootcamps
- Premium puzzle library not included (5 free puzzles available)
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Full access to the puzzle library
- Lab AI Assistant
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now