GumGum AMI Bakery

TL;DR: Packer + checksums = 👍

By Corey Gale

About Me

  • Corey Gale
  • Senior DevOps Engineer @ GumGum
  • Studied Mechatronics Engineering
  • 9 years of experience in software
    • 6 years in DevOps 
    • Telecom, Cloud Finance, Education, Travel, Consumer Electronics, Advertising

Project Goals

  • Define AMIs 100% in code
  • Use Hashicorp Packer
    • Dependable
    • -debug
  • Idempotent builds
    • AMIs are only re-built when their definition changes
  • Solution must be CI-friendly


  • Packer builds are not idempotent
    • Re-building the same code twice = 2 AMIs
  • Makes integrating Packer into your CI challenging


  • Introducing the GumGum AMI Bakery!
    • Ships as a Docker image
  • You tell the AMI Bakery where your AMI config code lives
  • The AMI Bakery will then re-build your AMI only if your AMI config code changes

GumGum AMI Bakery

Packer JSON

AMI config paths


docker pull mechtron/ami-bakery​

File Checksums

  • Digital signatures for files
    • Our AMI Bakery uses SHA1 checksums
  • Returns a 40 character hexidecimal value for files or strings of any size
  • If a file changes, so will its SHA1 checksum

AMI Bakery Algorithm

Get list of all

config files

Sort list

Calculate SHA1 of each file

Calculate SHA1 of list of file SHA1s

= ami_config_checksum

Does an

AMI exist with that



Build new AMI

Return existing AMI



Before The AMI Bakery 😥

  • AMI IDs were hard-coded
    • Required a manual code update
    • ... which humans sometimes forget to do
    • ... which lead to AMIs getting stale


Contains manually-pinned AMI IDs

After 😎

  • AMI Bakery stage inserted
    • If the AMI DNE, it is built
    • If it exists, the AMI's ID is returned
  • Terraform gets the AMI ID via CLI parameter

New stage

Updated stage



  • AMI updates are simple:
    • Update the AMI config code
    • That's it.
  • No external state
  • AMI config checksums remain the same between branch changes = faster builds


  • A little invasive
    • Need to update existing Terraform code to look up AMIs dynamically
    • But maybe that's a good thing?

AMI Bakery Code

  • Includes an example integration
    • sample-app sub-directory

WLAD Tip #0002

Question: "what's using all the disk space on this Debian system?"

Answer: apt install ncdu && ncdu /

WLAD Tip #0002

Example Pipeline Integration

docker run --rm -t \
    -e PACKER_JSON_PATH=`pwd`/example-app/ami/packer/ami.json \
    -e AMI_DEFINITION_DIRS=`pwd`/example-app/ami/ \
    --mount type=bind,source=`pwd`,target=`pwd` \
    --mount type=bind,source=$HOME/.aws/,target=/root/.aws \