在 Packer Build 后禁用 WinRM

如何解决在 Packer Build 后禁用 WinRM

这个问题之前可能有人问过，但我找不到参考。我正在使用打包程序来构建自定义 Windows AWS AMI。在打包程序构建之后，我使用 AMI 配置了一个 EC2 实例，并注意到 WinRM 服务正在运行，并且我在 user_data 中设置的防火墙规则也已启用。我不希望它成为我的形象构建的一部分。如何绕过它？ 这是我的打包模板：

{
    "variables": {
        "ami_region": "us-east-1","build_version": "{{isotime \"2006.01.02.150405\"}}","aws_vpc": "vpc-0cf252de620488ef2","vpc_subnet": "subnet-06909f11bbb49a814"
    },"builders": [
        {
            "type": "amazon-ebs","profile": "default","region": "{{user `ami_region`}}","vpc_id": "{{user `aws_vpc`}}","subnet_id": "{{user `vpc_subnet`}}","source_ami_filter": {
                "filters": {
                    "virtualization-type": "hvm","name": "Windows_Server-2016-English-Full-Base*","root-device-type": "ebs"
                },"owners": [
                    "amazon"
                ],"most_recent": true
            },"ami_name": "WIN2016-CUSTOM-{{user `build_version`}}","instance_type": "t3.medium","associate_public_ip_address": true,"user_data_file": "C:\\Users\\amita\\Documents\\DevOps\\AWS\\packer\\winrm.ps1","communicator": "winrm","winrm_username": "Administrator","winrm_port": 5986,"winrm_timeout": "15m","winrm_use_ssl": true,"winrm_insecure": true
        }
    ],"provisioners": [
        {
            "type": "powershell","script": "C:\\Users\\amita\\Documents\\DevOps\\AWS\\packer\\Install-Apps.ps1"
        },{
            "type": "windows-restart","restart_check_command": "powershell -command \"& {Write-Output 'restarted.'}\""
        },{
            "type": "powershell","inline": [
                "C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Scripts\\InitializeInstance.ps1 -Schedule","C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Scripts\\SysprepInstance.ps1 -NoShutdown"
            ]
        }
    ]
}

用户数据

<powershell>
write-output "Running User Data Script"
write-host "(host) Running User Data Script"

Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force -ErrorAction Ignore
$ErrorActionPreference = "stop"

# Remove HTTP listener
Remove-Item -Path WSMan:\Localhost\listener\listener* -Recurse

# Create self-signed certificate
$Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName "packer"
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint -Force

# WinRM
write-output "Setting up WinRM"
write-host "(host) setting up WinRM"
# Configure WinRM
cmd.exe /c winrm quickconfig -q
cmd.exe /c winrm set "winrm/config" '@{MaxTimeoutms="1800000"}'
cmd.exe /c winrm set "winrm/config/winrs" '@{MaxMemoryPerShellMB="1024"}'
cmd.exe /c winrm set "winrm/config/service" '@{AllowUnencrypted="true"}'
cmd.exe /c winrm set "winrm/config/client" '@{AllowUnencrypted="true"}'
cmd.exe /c winrm set "winrm/config/service/auth" '@{Basic="true"}'
cmd.exe /c winrm set "winrm/config/client/auth" '@{Basic="true"}'
cmd.exe /c winrm set "winrm/config/service/auth" '@{CredSSP="true"}'
cmd.exe /c winrm set "winrm/config/listener?Address=*+Transport=HTTPS" "@{Port=`"5986`";Hostname=`"packer`";CertificateThumbprint=`"$($Cert.Thumbprint)`"}"
cmd.exe /c netsh advfirewall firewall set rule group="remote administration" new enable=yes
cmd.exe /c netsh firewall add portopening TCP 5986 "WinRM_HTTPS"
cmd.exe /c net stop winrm
cmd.exe /c sc config winrm start= auto
cmd.exe /c net start winrm
</powershell>