packer-plugin-amazon
                                
                                 packer-plugin-amazon copied to clipboard
                                
                                    packer-plugin-amazon copied to clipboard
                            
                            
                            
                        Provisioning over IPv6 not possible
Currently provisioning instances via IPv6 is not possible. I encountered the following issues:
- No IPv6 address is assigned to the EC2 instance (in case IPv6 subnets exist) and there is no way to force it.
- The plugin by default creates a security group rule to allow SSH only for 0.0.0.0/0. It needs to create the same rule for::/0for IPv6, too.
- You can also not explicitly force this by setting temporary_security_group_source_cidrsto::/0, because that configuration option does not support IPv6 prefixes which is not documented.
- The plugin never tries to connect to SSH via IPv6 if available. When ssh_interfaceis set topublic_ip(default) orprivate_ipit should choose the assigned IPv6 address first.
This makes it impossible to use this plugin in IPv6-only environments.
After further investigation I suggest the following solutions:
- Automatically assigning an IPv6 address to the instance can only be done if we also check whether the used subnet has an IPv6 prefix assigned. As a first step we could instead add a new config option associate_ipv6_address(falseby default so we don't break existing setups with IPv4-only VPCs/subnets) that would eliminate the need for an automatic check.
- Just always add ::/0to the security group rules by default even if we don't use IPv6.
- Parse the prefixes in temporary_security_group_source_cidrsand add them to a new list containing instances ofec2.Ipv6Rangeif they are IPv6. That list can then be added to theec2.IpPermission(fieldIpv6Ranges).
- Connecting to SSH via IPv6 is tricky since it depends on whether the host running Packer has IPv6 connectivity and we cannot easily check for that. Normally you would simply achieve that with dualstack DNS hostnames and Happy Eyeballs (RFC 6555, trying IPv6 first with IPv4 as fallback), but since AWS does not provide a public dualstack hostname for EC2 instances this won't work. Instead I suggest to add a new value for ssh_interface, something likepublic_ipv6or justipv6. That way Packer will specifically choose the instance's IPv6 address to connect to it which should work together with the aforementionedassociate_ipv6_addressoption.
This of course means IPv6 will still be opt-in, because the mentioned config options need to be set accordingly, but it's better than not being able to connect via IPv6 at all.
I'll have a look if I can provide a PR.