Demo Installing Vault using Packer

This lesson shows how to use Packer to build a reusable Amazon Machine Image (AMI) that includes the Vault binary and example configuration files. You will learn how to:

Upload local Vault artifacts to a temporary EC2 instance that Packer launches.
(Optionally) automate installation steps with a shell provisioner.
Build and launch instances from the resulting AMI.

A screenshot of a GitHub repository page for a HashiCorp-related project, showing folder entries (consul, general, vault), a README section, and repository controls like Code, Issues, and Pull requests. The right side shows repo metadata such as stars, forks, and an About blurb.

Repository contents

The example repository contains materials for Consul, Vault, and a Packer directory with the template and supporting files.
The Packer directory (used in this lesson) includes:
- A Packer HCL template (vault.pkr.hcl)
- A local Vault ZIP (e.g., vault_1.7.1_linux_amd64.zip)
- Example Vault HCL configuration files and a systemd unit file under files/

Files referenced in the Packer template

File	Purpose
`vault_1.7.1_linux_amd64.zip`	Vault binary archive downloaded from HashiCorp releases
`vault.hcl`	Example Vault configuration (HCL)
`vault_int_storage.hcl`	Example Vault configuration using integrated storage
`vault.service`	systemd service unit for Vault

Why use Packer for Vault AMIs?

Create a reproducible AMI that already contains the Vault binary and example configs.
Speed up provisioning by avoiding manual install steps on every instance.
Optionally include installation and configuration as part of the Packer build.

Packer HCL template (cleaned example) Below is a consolidated example of the Packer HCL (vault.pkr.hcl) used in this lesson. It uploads local files to the temporary EC2 instance Packer launches. You can extend it with a provisioner "shell" to automate the unzip/install steps.

variable "aws_region" {
  type    = string
  default = env("AWS_REGION")
}

variable "vault_zip" {
  type    = string
  # Example path on Windows for the local zip used by Packer to upload.
  default = "C:\\Users\\btkra\\Downloads\\vault_1.7.1_linux_amd64.zip"
}

variable "vpc_id" {
  type    = string
  default = "vpc-xxxx"
}

variable "subnet_id" {
  type    = string
  default = "subnet-xxxx"
}

data "amazon-ami" "amazon-linux-2" {
  filters = {
    name                = "amzn2-ami-hvm-2.*-x86_64-gp2"
    root-device-type    = "ebs"
    virtualization-type = "hvm"
  }
  most_recent = true
  owners      = ["amazon"]
  region      = var.aws_region
}

source "amazon-ebs" "amazonlinux-2" {
  ami_description             = "Vault - Amazon Linux 2"
  ami_name                    = "vault-amazonlinux2-vault-course"
  ami_regions                 = ["us-east-1"]
  ami_virtualization_type     = "hvm"
  associate_public_ip_address = true
  force_delete_snapshot       = true
  force_deregister            = true
  instance_type               = "m5.large"
  region                      = var.aws_region
  source_ami                  = data.amazon-ami.amazon-linux-2.id
  spot_price                  = "0"
  ssh_pty                     = true
  ssh_timeout                 = "5m"
  ssh_username                = "ec2-user"
  tags = {
    Name = "HashiCorp Vault"
    OS   = "Amazon Linux 2"
  }
  subnet_id = var.subnet_id
  vpc_id    = var.vpc_id
}

build {
  sources = ["source.amazon-ebs.amazonlinux-2"]

  # Upload the local Vault ZIP to the temporary instance
  provisioner "file" {
    source      = var.vault_zip
    destination = "/tmp/vault.zip"
  }

  # Upload local "files/" directory contents (example configs and systemd unit)
  provisioner "file" {
    source      = "files/"
    destination = "/tmp/"
  }
}

You can override variables (region, VPC, subnet, vault_zip) by editing the defaults in the HCL file, setting environment variables, or passing variables at runtime with the Packer CLI.

Prerequisites

Packer installed locally (https://www.packer.io/).
AWS credentials configured (AWS CLI or environment variables).
The Vault ZIP downloaded locally from HashiCorp releases.
Target VPC and Subnet IDs where Packer should launch the temporary instance.

Preparing variables

Set vpc_id and subnet_id to the target network where Packer will launch the temporary instance. You can get these IDs from the AWS VPC and Subnets console.
Either set values directly in vault.pkr.hcl, export environment variables, or pass them with -var flags when running packer build.

Validate and build

Validate the template:

packer validate vault.pkr.hcl

Build the AMI:

packer build vault.pkr.hcl

Sample Packer build output This cleaned sample output highlights the important steps Packer performs during the build.

amazon-ebs.amazonlinux-2: output will be in this color.

==> amazon-ebs.amazonlinux-2: Force Deregister flag found, skipping prevalidating AMI Name
==> amazon-ebs.amazonlinux-2: Found Image ID: ami-0d5eff06f840b45e9
==> amazon-ebs.amazonlinux-2: Creating temporary keypair: packer_609a77bd-75d9-789a-e7bb-678aa50c931f
==> amazon-ebs.amazonlinux-2: Creating temporary security group for this instance: packer_609a77be-79de-c3f7-56ee-e31a1df32d85
==> amazon-ebs.amazonlinux-2: Authorizing access to port 22 from [0.0.0.0/0] in the temporary security groups...
==> amazon-ebs.amazonlinux-2: Launching a source AWS instance...
==> amazon-ebs.amazonlinux-2: Adding tags to source instance
==> amazon-ebs.amazonlinux-2: Instance ID: i-0abcdef1234567890
==> amazon-ebs.amazonlinux-2: Waiting for instance (i-0abcdef1234567890) to become ready...
==> amazon-ebs.amazonlinux-2: Using ssh communicator to connect: 3.89.183.252
==> amazon-ebs.amazonlinux-2: Waiting for SSH to become available...
==> amazon-ebs.amazonlinux-2: Connected to SSH!
==> amazon-ebs.amazonlinux-2: Uploading C:\Users\btkra\Downloads\vault_1.7.1_linux_amd64.zip => /tmp/vault.zip
==> amazon-ebs.amazonlinux-2: Uploading files => /tmp
==> amazon-ebs.amazonlinux-2: Stopping the source instance...
==> amazon-ebs.amazonlinux-2: Creating AMI "vault-amazonlinux2-vault-course" from instance i-0abcdef1234567890
==> amazon-ebs.amazonlinux-2: AMI: ami-088d3d610f152b957
==> amazon-ebs.amazonlinux-2: Waiting for AMI to become ready...
==> amazon-ebs.amazonlinux-2: AMI is now available: ami-088d3d610f152b957
==> amazon-ebs.amazonlinux-2: Cleaning up temporary resources...
Build 'amazon-ebs.amazonlinux-2' finished after 4m15s.

==> Builds finished. The artifacts of successful builds are:
--> amazon-ebs.amazonlinux-2: AMIs were created:
us-east-1: ami-088d3d610f152b957

Launching an instance from the new AMI

After the build completes, go to the EC2 -> AMIs console and find the new AMI.
Launch a new instance from that AMI (for testing, a t2.micro or similar is fine).
Attach an SSH key pair, choose a security group that permits your SSH source IP, and enable public IP if you want direct SSH access.

A screenshot of the AWS EC2 Launch Instance wizard showing "Step 3: Configure Instance Details" with fields for network, subnet, auto-assign public IP, IAM role, and other instance settings. The page is open in a browser window over a code editor UI.

Rename the instance in the EC2 console for clarity.

A screenshot of the AWS EC2 Management Console showing a list of EC2 instances with one instance selected and an "Edit Name" dialog open. The instance details pane is visible at the bottom, showing status and networking information.

Verify uploaded files and install Vault on the running instance

SSH into the instance (example user: ec2-user).
Check /tmp to confirm Packer uploaded the Vault ZIP and files:

cd /tmp
ls -l
# Example output:
# -rw-rw-r-- 1 ec2-user ec2-user   644 May 11 12:27 vault.hcl
# -rw-rw-r-- 1 ec2-user ec2-user   765 May 11 12:27 vault_int_storage.hcl
# -rw-rw-r-- 1 ec2-user ec2-user   896 May 11 12:27 vault.service
# -rw-rw-r-- 1 ec2-user ec2-user 68821345 May 11 12:27 vault.zip

Unzip the Vault binary and move it into a system path:

sudo unzip vault.zip
sudo mv vault /usr/local/bin/

Verify the binary and version:

/usr/local/bin/vault --version
# Example output:
# Vault v1.7.1 (917142287996a005cb1ed9d96d00d06a0590e44e)

Install configuration and service unit (manual example)

If you uploaded vault.service and configuration files, move them to the proper directories and enable the systemd service:

sudo mkdir -p /etc/vault
sudo mv /tmp/vault.hcl /etc/vault/vault.hcl
sudo mv /tmp/vault_int_storage.hcl /etc/vault/vault_int_storage.hcl
sudo mv /tmp/vault.service /etc/systemd/system/vault.service
sudo systemctl daemon-reload
sudo systemctl enable --now vault
sudo systemctl status vault

Automating installation inside Packer (optional)

To automate unzip + install during the Packer build, add a provisioner "shell" block to the build section that runs the commands above. This produces an AMI that is ready-to-run without manual post-launch steps.

Wrap-up and best practices

Building a Vault AMI with Packer creates a reproducible, versioned image that speeds up deployments.
Consider automating configuration templating and secrets injection at launch (for example, using cloud-init, user data, or a configuration management tool) rather than baking secrets into AMIs.
Keep the Vault binary up to date in your build pipeline and version AMIs to make rollbacks easier.

Links and references

Packer: https://www.packer.io/
HashiCorp Vault releases: https://releases.hashicorp.com
AWS EC2 AMIs documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html
Kubernetes Basics (related infrastructure concepts)

Introduction

Introduction to Vault

Learning the Vault Architecture

Installing Vault

Compare Authentication Methods

Create Vault Policies

Assess Vault Tokens

Compare and Configure Secrets Engines

Vault Agent

Vault Replication

Demo Installing Vault using Packer

Watch Video