EC2 Image BuilderでAMIの自動作成を試してみる

name: InstallPackages
description: Install additional packages
schemaVersion: 1.0

phases:
  - name: build                         # フェーズ名
    steps:
      - name: installPackages          # ステップ名(任意)
        action: ExecuteBash
        inputs:
          commands:
            - dnf update -y
            - dnf install -y python3-pip
            - pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu

# IAM ロールの作成
resource "aws_iam_role" "image_builder_role" {
  name = "EC2ImageBuilderRole"
  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Effect = "Allow",
      Principal = {
        Service = "ec2.amazonaws.com"
      },
      Action = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "image_builder_role_attach" {
  role       = aws_iam_role.image_builder_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" # 必要に応じて他のポリシーを添付
}
# すでに作成済みの ImageBuilderFullAccess に追加アタッチする例
resource "aws_iam_role_policy_attachment" "image_builder_role_attach_ec2img_full" {
  role       = aws_iam_role.image_builder_role.name
  policy_arn = "arn:aws:iam::aws:policy/AWSImageBuilderFullAccess"
}

resource "aws_iam_instance_profile" "image_builder_profile" {
  name = "EC2ImageBuilderInstanceProfile"
  role = aws_iam_role.image_builder_role.name
}

# コンポーネントの作成（外部 YAML を参照）
resource "aws_imagebuilder_component" "example_component" {
  name        = "example-component"
  version     = "1.0.0"
  platform    = "Linux"
  description = "Install packages example"

  data = file("${path.module}/component.yaml")
}

# Amazon Linux 2023 AMI lookup
data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["137112412989"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023*-kernel-*-x86_64"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# Security Groups for ec2
resource "aws_security_group" "ec2_sg" {
  name        = "imagebuilder_ec2_sg"
  description = "A security group for EC2 Image Builder"
  vpc_id      = var.vpc_id

  egress {
    description      = "Allow all outbound traffic"
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
}

# イメージレシピの作成
resource "aws_imagebuilder_image_recipe" "example_recipe" {
  name    = "example-recipe"
  version = "1.0.0"
  # 最新の Amazon Linux 2023 の AMI ID
  parent_image = data.aws_ami.amazon_linux.id

  component {
    component_arn = aws_imagebuilder_component.example_component.arn
  }
}

# インフラ構成の作成
resource "aws_imagebuilder_infrastructure_configuration" "example_infra_config" {
  name                          = "example-infra-config"
  instance_profile_name         = aws_iam_instance_profile.image_builder_profile.name
  security_group_ids            = [aws_security_group.ec2_sg.id]
  subnet_id                     = var.subnet_id # 適切なサブネットIDを指定
  instance_types                = ["t3.medium"]
  terminate_instance_on_failure = true
}

# イメージパイプラインの作成（スケジュールなしで手動実行）
resource "aws_imagebuilder_image_pipeline" "example_pipeline" {
  name                             = "example-image-pipeline"
  image_recipe_arn                 = aws_imagebuilder_image_recipe.example_recipe.arn
  infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.example_infra_config.arn
  status                           = "ENABLED"

  # schedule ブロックを省略 → 自動スケジュールなし
  # schedule {
  #   schedule_expression = "cron(0 0 * * ? *)"
  # }  
}

sh-5.2$ python3
Python 3.9.20 (main, Dec 11 2024, 00:00:00)
[GCC 11.4.1 20230605 (Red Hat 11.4.1-2)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import torch
>>> torch.__version__
'2.5.1+cpu'