Hacker News Reader

Actually, AWS does now support building AMIs and sharing it across an AWS Organization or OU: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-am.... If you're using Packer you want ami_org_arns to share with an org or ami_ou_arns to share with OUs https://www.packer.io/plugins/builders/amazon/ebs#ami_org_ar....

You do still need to create separate AMIs per region though

View on HN

This is great, thanks for your post.

Is a cross-region copy and a re-share better than rebuilding the AMI in the new region I wonder?

Penny for your thoughts?

Gonna depend on what you put in your AMI (how much / timing) and whether you have access to everything you need. Also, does your automation that drives packer (should?) have access to the other accounts.

Assuming that you're not hardcoding anything region-specific, a copy is likely going to be the preferred method since this way you know that the AMIs are the same (ie there's no way that a dependency updated). However there are two complicating factors that may persuade you the other way. Check the cost of cross-region data transfer vs the cost of building your AMI. If your AMI is particularly large, it may make more financial sense to just rebuild the AMI. The other complicating factor is encryption. You _can_ copy an encrypted AMI per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingA..., although perms can be a bit finicky. If you're encrypting something with a region-specific Vault or a HSM, then you'll likely need to rebuild the AMI

Reply on news.ycombinator.com