Having problems with Packer: amazon-ebs: Timeout waiting for SSH

Question

I'm new with Packer and I'm trying to create an image using a private network of the VPC and I'm continually having the error *amazon-ebs: Timeout waiting for SSH.*

The version of Packer in use is 1.3.4 and, the private subnet has access to a NAT Gateway through a public subnet and a route table. Butas the problem can be not be able to reach the instance then I also had tried with other parameters, like: ssh_interface with the value of private_dns and associate_public_ip_address. But even the changes I get the same error.

The template I'm using has the next content

"builders": [
{
  "type": "amazon-ebs",
  "access_key": "{{user `aws_access_key`}}",
  "secret_key": "{{user `aws_secret_key`}}",
  "region": "{{user `region`}}",
  "source_ami": "{{user `source_ami`}}",
  "instance_type": "{{user `instance_type`}}",
  "iam_instance_profile": "{{user `role`}}",
  "ssh_username": "{{user `ssh_username`}}",
  "ssh_timeout": "15m",
  "vpc_id": "{{user `vpc_id`}}",
  "subnet_id": "{{user `subnet_id`}}",
  "associate_public_ip_address": true,
  "ami_name": "{{user `name`}}.{{isotime \"2006-01-02T150405Z\"}}",
  "ami_description": "based on {{user `source_ami`}}",
  "tags": {
    "Name": "{{user `name`}}"
  }]

In the template I'm not defining the Security Group, but in the logs of Packer I'm seeing that it's able to create a temporary security group, then also the access to port 22 should be available

==> amazon-ebs: Pausing after run of step 'StepKeyPair'. Press enter to continue. 
==> amazon-ebs: Creating temporary security group for this instance: packer_5
c6b3667-c41f-92bc-aa89-efc5f3a2d8a8
==> amazon-ebs: Authorizing access to port 22 from 0.0.0.0/0 in the temporary security group...
==> amazon-ebs: Pausing after run of step 'StepSecurityGroup'. Press enter to continue. 
==> amazon-ebs: Pausing after run of step 'StepCleanupVolumes'. Press enter to continue. 
==> amazon-ebs: Launching a source AWS instance...

But the problem persists. Is there something that I'm missing in the template? or something that I should do different to generate the AMI?

Answer 1

You cannot access to an ec2 through a NAT Gateway. NAT Gateways in AWS are used to give Internet access from a VPC not to a VPC.

You have several options:

1. Make packer launches the ec2 in a public subnet with a public ip. Have an IGW properly configured in the VPC and routing table
2. Have a secure bastion host deployed in AWS and use it to jump from the workstation with packer to the ec2. You will need to configure few things in your packer.json using a custom communicator. Here the documentation https://www.packer.io/docs/templates/communicator.html#ssh

Regards