Merge branch 'main' into authorization-bypass

sanyaraj2424 · sanyaraj2424 · commit 71536c2aae14 · 2026-05-22T21:09:20.000+05:30
diff --git a/.github/actions/build-and-persist-plugin-binary/action.yml b/.github/actions/build-and-persist-plugin-binary/action.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 name: build-and-persist-plugin-binary
diff --git a/.github/release.yml b/.github/release.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 changelog:
diff --git a/.golangci.yml b/.golangci.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 issues:
diff --git a/.release/ci.hcl b/.release/ci.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
 schema = "2"
diff --git a/.release/packer-plugin-amazon-artifacts.hcl b/.release/packer-plugin-amazon-artifacts.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 schema = 1
diff --git a/.release/release-metadata.hcl b/.release/release-metadata.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 url_source_repository         = "https://github.com/hashicorp/packer-plugin-amazon"
diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 # Reference: https://github.com/hashicorp/security-scanner/blob/main/CONFIG.md#binary (private repository)
diff --git a/.web-docs/metadata.hcl b/.web-docs/metadata.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 # For full specification on the configuration of this file visit:
diff --git a/.web-docs/scripts/compile-to-webdocs.sh b/.web-docs/scripts/compile-to-webdocs.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2013, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,16 @@
 # Latest Release
 
 Please refer to [releases](https://github.com/hashicorp/packer-plugin-amazon/releases) for the latest CHANGELOG information.
+---
+## x.x.x (Unreleased)
+
+## 🐛 Bug Fixes
+- **Fix ShouldRetry callbacks not receiving error from retry framework** – by @tjouni
+  Several `ShouldRetry` callbacks had unnamed function parameters, causing them to
+  reference the outer scope's error variable instead of the error passed by the retry
+  framework. This prevented retries from working for transient AWS API errors such as
+  `InvalidAMIID.NotFound`, `InvalidSnapshot.NotFound`, and `InvalidInstanceID.NotFound`.
+
 ---
 ## 1.8.0 (November 19, 2025)
 
diff --git a/builder/common/step_create_tags.go b/builder/common/step_create_tags.go
@@ -102,7 +102,7 @@ func (s *StepCreateTags) Run(ctx context.Context, state multistep.StateBag) mult
 		snapshotTags.Report(ui)
 
 		// Retry creating tags for about 2.5 minutes
-		err = retry.Config{Tries: 11, ShouldRetry: func(error) bool {
+		err = retry.Config{Tries: 11, ShouldRetry: func(err error) bool {
 			if awserrors.Matches(err, "InvalidAMIID.NotFound", "") || awserrors.Matches(err, "InvalidSnapshot.NotFound", "") {
 				return true
 			}
diff --git a/builder/common/step_run_source_instance.go b/builder/common/step_run_source_instance.go
@@ -364,7 +364,7 @@ func (s *StepRunSourceInstance) Run(ctx context.Context, state multistep.StateBa
 	if s.IsRestricted {
 		ec2Tags.Report(ui)
 		// Retry creating tags for about 2.5 minutes
-		err = retry.Config{Tries: 11, ShouldRetry: func(error) bool {
+		err = retry.Config{Tries: 11, ShouldRetry: func(err error) bool {
 			if awserrors.Matches(err, "InvalidInstanceID.NotFound", "") {
 				return true
 			}
diff --git a/builder/common/step_run_spot_instance.go b/builder/common/step_run_spot_instance.go
@@ -510,7 +510,7 @@ func (s *StepRunSpotInstance) Run(ctx context.Context, state multistep.StateBag)
 		// Apply tags to the spot request.
 		err = retry.Config{
 			Tries:       11,
-			ShouldRetry: func(error) bool { return false },
+			ShouldRetry: func(err error) bool { return false },
 			RetryDelay:  (&retry.Backoff{InitialBackoff: 200 * time.Millisecond, MaxBackoff: 30 * time.Second, Multiplier: 2}).Linear,
 		}.Run(ctx, func(ctx context.Context) error {
 			_, err := ec2conn.CreateTags(&ec2.CreateTagsInput{
diff --git a/builder/common/step_stop_ebs_instance.go b/builder/common/step_stop_ebs_instance.go
@@ -45,7 +45,7 @@ func (s *StepStopEBSBackedInstance) Run(ctx context.Context, state multistep.Sta
 		// does not exist.
 
 		// Work around this by retrying a few times, up to about 5 minutes.
-		err := retry.Config{Tries: 6, ShouldRetry: func(error) bool {
+		err := retry.Config{Tries: 6, ShouldRetry: func(err error) bool {
 			if awserrors.Matches(err, "InvalidInstanceID.NotFound", "") {
 				return true
 			}
diff --git a/builder/ebs/builder_acc_test.go b/builder/ebs/builder_acc_test.go
@@ -1,4 +1,4 @@
-// Copyright IBM Corp. 2013, 2025
+// Copyright IBM Corp. 2013, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 /*
@@ -317,14 +317,38 @@ func TestAccBuilder_EbsForceDeleteSnapshot(t *testing.T) {
 func checkSnapshotsDeleted(snapshotIds []string) error {
 	ctx := context.TODO()
 	// Verify the snapshots are gone
-	ec2conn, _ := testEC2Conn("us-east-1")
-	snapshotResp, _ := ec2conn.DescribeSnapshots(ctx,
+	ec2conn, err := testEC2Conn("us-east-1")
+	if err != nil {
+		return fmt.Errorf("failed to create EC2 connection: %w", err)
+	}
+
+	snapshotResp, err := ec2conn.DescribeSnapshots(ctx,
 		&ec2.DescribeSnapshotsInput{SnapshotIds: snapshotIds},
 	)
 
+	// In AWS SDK v2, when snapshots are deleted, DescribeSnapshots returns an error
+	// with code "InvalidSnapshot.NotFound". This is the expected behavior.
+	if err != nil {
+		// Check if the error is InvalidSnapshot.NotFound, which means snapshots are deleted
+		errMsg := err.Error()
+		if strings.Contains(errMsg, "InvalidSnapshot.NotFound") {
+			// Snapshots are successfully deleted
+			return nil
+		}
+		// Some other error occurred
+		return fmt.Errorf("error describing snapshots: %w", err)
+	}
+
+	// If no error and response is not nil, check if snapshots still exist
+	if snapshotResp == nil {
+		return fmt.Errorf("received nil response from DescribeSnapshots")
+	}
+
 	if len(snapshotResp.Snapshots) > 0 {
-		return fmt.Errorf("Snapshots weren't successfully deleted by `force_delete_snapshot`")
+		return fmt.Errorf("Snapshots weren't successfully deleted by `force_delete_snapshot`: found %d snapshot(s)", len(snapshotResp.Snapshots))
 	}
+
+	// No error, no snapshots found - they are deleted
 	return nil
 }
 
@@ -372,7 +396,11 @@ func checkAMISharing(ami amazon_acc.AMIHelper, count int, uid, group string) err
 		return fmt.Errorf("failed to find ami %s at region %s", ami.Name, ami.Region)
 	}
 
-	ec2Client, _ := testEC2Conn("us-east-1")
+	ec2Client, err := testEC2Conn("us-east-1")
+	if err != nil {
+		return fmt.Errorf("failed to create EC2 connection: %w", err)
+	}
+
 	imageResp, err := ec2Client.DescribeImageAttribute(ctx, &ec2.DescribeImageAttributeInput{
 		Attribute: "launchPermission",
 		ImageId:   images[0].ImageId,
@@ -550,14 +578,21 @@ func checkBootEncrypted(ami amazon_acc.AMIHelper) error {
 	}
 	ctx := context.TODO()
 	// describe the image, get block devices with a snapshot
-	ec2Client, _ := testEC2Conn(ami.Region)
+	ec2Client, err := testEC2Conn(ami.Region)
+	if err != nil {
+		return fmt.Errorf("failed to create EC2 connection: %w", err)
+	}
+
 	imageResp, err := ec2Client.DescribeImages(ctx, &ec2.DescribeImagesInput{
 		ImageIds: []string{*images[0].ImageId},
 	})
 
 	if err != nil {
 		return fmt.Errorf("Error retrieving Image Attributes for AMI (%s) in AMI Encrypted Boot Test: %s", ami.Name, err)
 	}
+	if imageResp == nil || len(imageResp.Images) == 0 {
+		return fmt.Errorf("received nil or empty response from DescribeImages")
+	}
 
 	image := imageResp.Images[0] // Only requested a single AMI ID
 
@@ -687,6 +722,9 @@ func checkDeprecationEnabled(ami amazon_acc.AMIHelper, deprecationTime time.Time
 	if err != nil {
 		return fmt.Errorf("Error Describe Image for AMI (%s): %s", ami.Name, err)
 	}
+	if imageResp == nil || len(imageResp.Images) == 0 {
+		return fmt.Errorf("received nil or empty response from DescribeImages")
+	}
 
 	expectTime := deprecationTime.Round(time.Minute)
 	expectTimeStr := expectTime.Format(time.RFC3339)
@@ -1459,13 +1497,20 @@ func checkAMITags(ami amazon_acc.AMIHelper, tagList map[string]string) error {
 	amiNameRegion := fmt.Sprintf("%s/%s", ami.Region, ami.Name)
 
 	// describe the image, get block devices with a snapshot
-	ec2Client, _ := testEC2Conn(ami.Region)
+	ec2Client, err := testEC2Conn(ami.Region)
+	if err != nil {
+		return fmt.Errorf("failed to create EC2 connection: %w", err)
+	}
+
 	imageResp, err := ec2Client.DescribeImages(ctx, &ec2.DescribeImagesInput{
 		ImageIds: []string{*images[0].ImageId},
 	})
 	if err != nil {
 		return fmt.Errorf("failed to describe AMI %q: %s", amiNameRegion, err)
 	}
+	if imageResp == nil || len(imageResp.Images) == 0 {
+		return fmt.Errorf("received nil or empty response from DescribeImages for AMI %q", amiNameRegion)
+	}
 
 	var errs error
 	image := imageResp.Images[0] // Only requested a single AMI ID
@@ -1816,6 +1861,9 @@ func checkDeregistrationProtectionEnabled(ami amazon_acc.AMIHelper) error {
 	if err != nil {
 		return fmt.Errorf("Error Describe Image for AMI (%s): %s", ami.Name, err)
 	}
+	if imageResp == nil || len(imageResp.Images) == 0 {
+		return fmt.Errorf("received nil or empty response from DescribeImages")
+	}
 
 	image := imageResp.Images[0]
 	if image.DeregistrationProtection == nil {
@@ -1987,7 +2035,7 @@ const testBuilderAccSessionManagerInterface = `
 const testBuilderAccSSMWithReboot = `
 source "amazon-ebs" "test" {
 	ami_name             = "%s"
-	source_ami           = "ami-00874d747dde814fa" # Ubuntu Server 22.04 LTS
+	source_ami           = "ami-0b4a8cd67f04e48b7" #  hc-base-ubuntu-2204-20260330144317
 	instance_type        = "m3.medium"
 	region               = "us-east-1"
 	ssh_username         = "ubuntu"
@@ -2045,10 +2093,10 @@ build {
 const testPrivateKeyFileWithReboot = `
 source "amazon-ebs" "test" {
 	ami_name             = "%s"
-	source_ami           = "ami-00874d747dde814fa" # Ubuntu Server 22.04 LTS
+	source_ami           = "ami-0b5eea76982371e91" # Amazon Linux 2 AMI - kernel 5.10
 	instance_type        = "m3.medium"
 	region               = "us-east-1"
-	ssh_username         = "ubuntu"
+	ssh_username         = "ec2-user"
 	ssh_interface        = "session_manager"
 	iam_instance_profile = "SSMInstanceProfile"
 	communicator         = "ssh"
@@ -2072,7 +2120,7 @@ build {
 const testIMDSv2Support = `
 source "amazon-ebs" "test" {
 	ami_name             = "%s"
-	source_ami           = "ami-00874d747dde814fa" # Ubuntu Server 22.04 LTS
+	source_ami           = "ami-0b4a8cd67f04e48b7" #  hc-base-ubuntu-2204-20260330144317
 	instance_type        = "m3.medium"
 	region               = "us-east-1"
 	ssh_username         = "ubuntu"
@@ -2090,7 +2138,7 @@ build {
 const testAMIRunTagsCopyKeepRunTags = `
 source "amazon-ebs" "test" {
 	region        = "us-east-1"
-	source_ami    = "ami-00874d747dde814fa" # Ubuntu Server 22.04 LTS
+	source_ami    = "ami-0b4a8cd67f04e48b7" #  hc-base-ubuntu-2204-20260330144317
 	instance_type = "m3.medium"
 	ami_name      = "%s"
 	communicator  = "ssh"
@@ -2115,7 +2163,7 @@ build {
 const testAMIRunTagsCopyKeepTags = `
 source "amazon-ebs" "test" {
 	region        = "us-east-1"
-	source_ami    = "ami-00874d747dde814fa" # Ubuntu Server 22.04 LTS
+	source_ami    = "ami-0b4a8cd67f04e48b7" #  hc-base-ubuntu-2204-20260330144317
 	instance_type = "m3.medium"
 	ami_name      = "%s"
 	communicator  = "ssh"
@@ -2157,7 +2205,7 @@ build {
 const sshPasswordEnabledAMI = `
 source "amazon-ebs" "test" {
 	region        = "us-east-1"
-	source_ami    = "ami-00874d747dde814fa" # Ubuntu Server 22.04 LTS
+	source_ami    = "ami-0b4a8cd67f04e48b7" #  hc-base-ubuntu-2204-20260330144317
 	instance_type = "m3.medium"
 	ami_name      = "%s"
 	communicator  = "ssh"
@@ -2176,7 +2224,7 @@ build {
 				"set -e",
 				"sudo su",
 				"echo 'Enabling SSH password authentication...'",
-				"sudo sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config",
+				"sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication yes/' /etc/ssh/sshd_config",
 				"sudo useradd -m -s /bin/bash user",
 				"echo 'Setting up password for user'",
 				"echo 'user:password' | sudo chpasswd ubuntu",
diff --git a/common/allocation_strategy.go b/common/allocation_strategy.go
@@ -1,3 +1,6 @@
+// Copyright IBM Corp. 2013, 2026
+// SPDX-License-Identifier: MPL-2.0
+
 package common
 
 import (
diff --git a/common/allocation_strategy_test.go b/common/allocation_strategy_test.go
@@ -1,3 +1,6 @@
+// Copyright IBM Corp. 2013, 2026
+// SPDX-License-Identifier: MPL-2.0
+
 package common
 
 import "testing"
diff --git a/common/run_config.go b/common/run_config.go
@@ -1,4 +1,4 @@
-// Copyright IBM Corp. 2013, 2025
+// Copyright IBM Corp. 2013, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 //go:generate packer-sdc struct-markdown
diff --git a/common/run_config_test.go b/common/run_config_test.go
@@ -1,4 +1,4 @@
-// Copyright IBM Corp. 2013, 2025
+// Copyright IBM Corp. 2013, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package common
diff --git a/common/ssh.go b/common/ssh.go
@@ -1,4 +1,4 @@
-// Copyright IBM Corp. 2013, 2025
+// Copyright IBM Corp. 2013, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package common
diff --git a/common/ssh_test.go b/common/ssh_test.go
@@ -1,4 +1,4 @@
-// Copyright IBM Corp. 2013, 2025
+// Copyright IBM Corp. 2013, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package common
diff --git a/common/step_create_tags.go b/common/step_create_tags.go
@@ -106,7 +106,7 @@ func (s *StepCreateTags) Run(ctx context.Context, state multistep.StateBag) mult
 		snapshotTags.Report(ui)
 
 		// Retry creating tags for about 2.5 minutes
-		err = retry.Config{Tries: 11, ShouldRetry: func(error) bool {
+		err = retry.Config{Tries: 11, ShouldRetry: func(err error) bool {
 			if awserrors.Matches(err, "InvalidAMIID.NotFound", "") || awserrors.Matches(err, "InvalidSnapshot.NotFound", "") {
 				return true
 			}
diff --git a/common/step_run_source_instance.go b/common/step_run_source_instance.go
@@ -368,7 +368,7 @@ func (s *StepRunSourceInstance) Run(ctx context.Context, state multistep.StateBa
 	if s.IsRestricted {
 		ec2Tags.Report(ui)
 		// Retry creating tags for about 2.5 minutes
-		err = retry.Config{Tries: 11, ShouldRetry: func(error) bool {
+		err = retry.Config{Tries: 11, ShouldRetry: func(err error) bool {
 			if awserrors.Matches(err, "InvalidInstanceID.NotFound", "") {
 				return true
 			}
diff --git a/common/step_run_spot_instance.go b/common/step_run_spot_instance.go
@@ -515,7 +515,7 @@ func (s *StepRunSpotInstance) Run(ctx context.Context, state multistep.StateBag)
 		// Apply tags to the spot request.
 		err = retry.Config{
 			Tries:       11,
-			ShouldRetry: func(error) bool { return false },
+			ShouldRetry: func(err error) bool { return false },
 			RetryDelay:  (&retry.Backoff{InitialBackoff: 200 * time.Millisecond, MaxBackoff: 30 * time.Second, Multiplier: 2}).Linear,
 		}.Run(ctx, func(ctx context.Context) error {
 			_, err := ec2Client.CreateTags(ctx, &ec2.CreateTagsInput{
diff --git a/common/step_security_group.go b/common/step_security_group.go
@@ -1,4 +1,4 @@
-// Copyright IBM Corp. 2013, 2025
+// Copyright IBM Corp. 2013, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package common
diff --git a/common/step_stop_ebs_instance.go b/common/step_stop_ebs_instance.go
@@ -48,7 +48,7 @@ func (s *StepStopEBSBackedInstance) Run(ctx context.Context, state multistep.Sta
 		// does not exist.
 
 		// Work around this by retrying a few times, up to about 5 minutes.
-		err := retry.Config{Tries: 6, ShouldRetry: func(error) bool {
+		err := retry.Config{Tries: 6, ShouldRetry: func(err error) bool {
 			if awserrors.Matches(err, "InvalidInstanceID.NotFound", "") {
 				return true
 			}
diff --git a/go.mod b/go.mod
diff --git a/go.sum b/go.sum

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-# Copyright (c) HashiCorp, Inc.`
	`1`	`+# Copyright IBM Corp. 2013, 2026`
`2`	`2`	`# SPDX-License-Identifier: MPL-2.0`
`3`	`3`
`4`	`4`	`name: build-and-persist-plugin-binary`