title: Create a Windows AMI with packer and ansible on AWS
body: <p>I want to create an aws windows AMI with packer and ansible.</p>
  
  <p>I have tried many configuration, but I have still a problem of connection to the instance.</p>
  
  <p>Here is my packer conf :</p>
  
  <pre><code>{
    "builders": [{
      "type": "amazon-ebs",
      "access_key": "{{user `aws_access_key`}}",
      "secret_key": "{{user `aws_secret_key`}}",
      "region": "eu-west-1",
      "source_ami": "ami-58a1a73e",
      "instance_type": "m3.medium",
      "ami_name": "aaa-windows-ami {{timestamp}}",
      "user_data_file":"./test.ps",
      "communicator": "winrm",
      "winrm_username": "Administrator",
      "winrm_use_ssl": true,
      "winrm_insecure": true
    }],
  
    "provisioners": [
      {
        "type": "ansible",
        "playbook_file": "./playbook.yml",
        "extra_arguments": [
          "--extra-vars", "ansible_user=Administrator ansible_connection=winrm ansible_ssh_port=5986 ansible_winrm_server_cert_validation=ignore ansible_shell_type=powershell ansible_shell_executable=None"
        ]
      },
      {
        "type": "powershell",
        "script": "./init.ps1"
      }
    ]
  }
  </code></pre>
  
  <p>The User data script is activating winrm on the AWS instance.</p>
  
  <pre><code>&lt;powershell&gt;
  
  write-output "Running User Data Script"
  write-host "(host) Running User Data Script"
  
  Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force -ErrorAction Ignore
  
  # Don't set this before Set-ExecutionPolicy as it throws an error
  $ErrorActionPreference = "stop"
  
  # Remove HTTP listener
  Remove-Item -Path WSMan:\Localhost\listener\listener* -Recurse
  
  Set-Item WSMan:\localhost\MaxTimeoutms 1800000
  Set-Item WSMan:\localhost\Service\Auth\Basic $true
  
  $Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName "packer"
  New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint -Force
  
  # WinRM
  write-output "Setting up WinRM"
  write-host "(host) setting up WinRM"
  
  cmd.exe /c winrm quickconfig -q
  cmd.exe /c winrm set "winrm/config" '@{MaxTimeoutms="1800000"}'
  cmd.exe /c winrm set "winrm/config/winrs" '@{MaxMemoryPerShellMB="1024"}'
  cmd.exe /c winrm set "winrm/config/service" '@{AllowUnencrypted="true"}'
  cmd.exe /c winrm set "winrm/config/client" '@{AllowUnencrypted="true"}'
  cmd.exe /c winrm set "winrm/config/service/auth" '@{Basic="true"}'
  cmd.exe /c winrm set "winrm/config/client/auth" '@{Basic="true"}'
  cmd.exe /c winrm set "winrm/config/service/auth" '@{CredSSP="true"}'
  cmd.exe /c winrm set "winrm/config/listener?Address=*+Transport=HTTPS" "@{Port=`"5986`";Hostname=`"packer`";CertificateThumbprint=`"$($Cert.Thumbprint)`"}"
  cmd.exe /c netsh advfirewall firewall set rule group="remote administration" new enable=yes
  cmd.exe /c netsh firewall add portopening TCP 5986 "Port 5986"
  cmd.exe /c net stop winrm
  cmd.exe /c sc config winrm start= auto
  cmd.exe /c net start winrm
  
  &lt;/powershell&gt;
  </code></pre>
  
  <p>The error is.</p>
  
  <pre><code>==&gt; amazon-ebs: Provisioning with Ansible...
      amazon-ebs:
      amazon-ebs: PLAY [all] *********************************************************************
      amazon-ebs:
      amazon-ebs: TASK [setup] *******************************************************************
      amazon-ebs: fatal: [default]: UNREACHABLE! =&gt; {"changed": false, "msg": "ssl: auth method ssl requires a password", "unreachable": true}
      amazon-ebs:     to retry, use: --limit @/home/elhostis/repo/vagrant/playbook.retry
      amazon-ebs:
      amazon-ebs: PLAY RECAP *********************************************************************
      amazon-ebs: default                    : ok=0    changed=0    unreachable=1    failed=0
      amazon-ebs:
  ==&gt; amazon-ebs: Terminating the source AWS instance...
  ==&gt; amazon-ebs: Cleaning up any extra volumes...
  ==&gt; amazon-ebs: No volumes to clean up, skipping
  ==&gt; amazon-ebs: Deleting temporary security group...
  ==&gt; amazon-ebs: Deleting temporary keypair...
  </code></pre>
  
  <p>I have also tried to create manually an AMI with a known username/password. Then, I have configured ansible with theses credentials, but I have this error.</p>
  
  <pre><code>==&gt; amazon-ebs: Timeout waiting for password.
  ==&gt; amazon-ebs: Terminating the source AWS instance...
  ==&gt; amazon-ebs: Cleaning up any extra volumes...
  ==&gt; amazon-ebs: No volumes to clean up, skipping
  ==&gt; amazon-ebs: Deleting temporary security group...
  ==&gt; amazon-ebs: Deleting temporary keypair...
  Build 'amazon-ebs' errored: Timeout waiting for password.
  </code></pre>
  
  <p>Someone have an example to do that ?</p>
  
  <p>Thanks a lot.</p>
  
  <p>Eric</p>