Immediately revoke insecure image iterations
Over the lifecycle of a machine image, you may need to prevent access to it if it becomes insecure. HCP Packer lets you revoke an image iteration immediately. This strengthens your security posture by preventing usage of an insecure image that has been found to have a vulnerability.
In this tutorial, you will revoke an image iteration. You will review the relationship between HCP Packer image channels and revoked iterations, and how image revocation prevents downstream image consumers from referencing insecure images.
Prerequisites
To complete this tutorial, you must have completed the previous tutorials. In the previous tutorials, you:
- Created a service principal.
- Set your client ID and secret as environment variables.
- Configured your AWS credentials as environment variables.
- Built an image and pushed its metadata to HCP Packer.
- Set up a channel named
production
for your image bucket.
In addition, you will need:
- Terraform 1.2.0+ installed locally.
Revoke image iteration
Assume you just discovered a new security vulnerability in the second iteration of your learn-packer-ubuntu
image. To prevent users from referencing the iteration's images, you will immediately revoke the second iteration.
On the learn-packer-ubuntu
's Iterations page, revoke the second iteration by clicking on ..., then Revoke iteration.
Enter Learning about immediate revocation
for the revocation reason.
Tip
A revocation reason is optional, but we recommend providing one so your team understands why you revoked the iteration.
Select Revoke immediately from the When? dropdown menu.
Then select Yes, rollback channel from the Rollback channels? dropdown menu.
Finally, click Revoke to revoke the iteration.
HCP Packer now shows the overview page for the second iteration, which contains the revocation reason.
Retrieve the iteration ID – it is the field in the URL between /iterations/
and ?project_id
, replaced by ITERATION_ID
in the example link below. You will use this in the next step to verify that no one can use this iteration.
Now, select Back to iterations. The Iterations page now shows that the second iteration is revoked, and that the production
and latest
channels rolled back to the first iteration.
Verify image iteration revocation
When you revoke an image iteration, it becomes unavailable to image channels. You cannot assign a revoked iteration to a channel.
Change into the tf-revoked-iteration
directory.
The configuration in this directory defines a data source that queries the iteration of the learn-packer-ubuntu
image specified by the iteration_id
input variable. If HCP Packer returns an iteration that is not revoked, Terraform will create a compute instance with the image ID.
The lifecycle precondition will succeed if revoke_at
is scheduled to the future or is null.
Open tf-revoked-iteration/terraform.tfvars
in your editor. Set iteration_id
to the iteration ID you retrieved in the previous step, then save the file.
Initialize your Terraform configuration.
Because the lifecycle custom precondition depends on timestamp()
which is unknown during a Terraform plan, the condition will be checked during the Terraform apply.
Apply your configuration. Since hcp_packer_image
references a revoked iteration, the image_revocation_date
output is set to the revocation timestamp. The app_server
lifecycle precondition will fail, and Terraform will not create the EC2 instance.
Restore revoked iteration
If you accidentally revoke the wrong iteration, you can restore the iteration so your team can use it again.
In the HCP Packer UI, navigate to the second iteration. Then, click Manage and Restore iteration.
Click Restore iteration to restore your iteration.
Select Back to iterations. The iterations page shows that the second iteration is active again. Notice that the production
channel uses the first iteration, and the latest
channel once again uses the second iteration.
Verify restoration
Apply your configuration. Since the iteration is restored, Terraform successfully creates the EC2 instance.
To clean up your provisioned infrastructure, run terraform destroy
and respond yes
to the prompt to confirm the operation.
Next steps
In this tutorial, you revoked an HCP Packer image iteration and used automatic rollback to update the channels that used the iteration. Revocation prevents users from using insecure images and ensures that your organization uses compliant images.
For more information on topics covered in this tutorial, check out the following resources:
- Read more about revoking image iterations in the HCP Packer documentation.
- Complete the Schedule Image Iterations Revocation for Compliance tutorial to learn how to schedule iteration revocation to prevent users from referencing outdated images. Scheduled revocation is an HCP Packer Plus tier feature.
- Visit the Terraform
hcp
provider for a full list of arguments and attributes for thehcp_packer_iteration
andhcp_packer_image
data resources. - Complete the Set Up Terraform Cloud Run Task for HCP Packer tutorial to learn how to set up run tasks that ensure your Terraform configuration uses compliant machine images.