cs-image-system-aws-runtime-plugin 0.1.1__py3-none-any.whl

cs_image_system/aws_runtime/aws_runtime_builders.py

@@ -0,0 +1,518 @@
+# SPDX-FileCopyrightText: 2026 Mykel Alvis <mykelalvis@infrastructurebuilder.org>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+import logging
+from collections.abc import Mapping
+from typing import Any
+
+
+from cs_image_system.base.basic.abstract_version_checker import AbstractVersionChecker
+from cs_image_system.base.basic.asset import AssetSet
+from cs_image_system.base.basic.builder_base_cloud import CloudBuilderBase
+from cs_image_system.base.constants import VCT
+from cs_image_system.base.lifecycle import ExecutionLifecyclePhase
+from cs_image_system.base.models.os_builder_runtime_config import OSBuilderBaseImageBuilderSubconfig
+from cs_image_system.base.models.provider_specific_image import ProviderSpecificImage
+from cs_image_system.base import power_state
+from cs_image_system.base.protocols.plugin_metadata import PluginArtifactProtocol
+
+from .aws_provider_specific_image import AwsProviderSpecificImage
+from .aws_runtime_models import AWS_CLI, AwsCloudBuilderModel
+from .aws_utils import remap_for_image_query, query_image
+from cs_image_system.aws_runtime import aws_utils
+
+log = logging.getLogger(__name__)
+
+
+AWS_RUNTIME: str = "aws"  
+
+
+
+class AwsCloudBuilder(CloudBuilderBase[AwsCloudBuilderModel], PluginArtifactProtocol):
+    """AWS cloud provider implementation."""
+
+    @classmethod
+    def csis_name(cls) -> str:
+        return AWS_RUNTIME
+
+    @property
+    def model(self) -> AwsCloudBuilderModel:
+        return self._model # type: ignore
+
+    def provider_specific_image_class(self) -> type[ProviderSpecificImage]:
+        return AwsProviderSpecificImage
+
+    def query_provider_image(self, os_builder: OSBuilderBaseImageBuilderSubconfig) -> tuple[str, str, Mapping[str,Any]] | None:
+        retval: str | None = None
+        q,missed = remap_for_image_query(os_builder) if os_builder else ({}, {})
+        kv = query_image(
+                query=q,
+                post_query_filter=missed,
+                session_config=self.model.self_to_aws_client_config(),
+            )
+        if kv:
+            retval = kv.get("ImageId", None)
+        else:
+            kv = {}
+        
+        regstr = "self"
+        if retval:
+            region = self.model.get_region()
+            if not region:
+                raise ValueError(f"Region must be specified in builder config to resolve image identifier, but got {region}")
+            # the owner's alias (e.g. `amazon`) when AWS gives one, else the account id
+            _r = kv.get("ImageOwnerAlias") or kv.get("OwnerId")
+            if not _r:
+                raise ValueError(f"Could not get owner alias or owner id for image {retval} in region {region}, got {kv}")
+            regstr = str(_r)
+        return (retval,regstr, kv) if retval else None
+
+    def query_provider_image_by_id(self, os_builder: OSBuilderBaseImageBuilderSubconfig,
+                                   image_id: str) -> tuple[str, str, Mapping[str, Any]] | None:
+        """The AMI an entry pins by ``image_id`` (stage 63), looked up with
+        DescribeImages by id; its owner is the alias when AWS gives one."""
+        kv = aws_utils._query_by_ami_id(aws_utils.ec2_client(self.model.self_to_aws_client_config()), image_id)
+        if not kv:
+            return None
+        owner = kv.get("ImageOwnerAlias") or kv.get("OwnerId") or "self"
+        return (str(kv.get("ImageId") or image_id), str(owner), kv)
+
+    # def resolve_image_for_os_builder(
+    #     self, os_builder: OsBuilderProtocol
+    # ) -> Image | None:
+    #     ret: Image | None = None
+    #     rc = os_builder.get_configs_for_runtimes().get(self.name,None)
+    #     assert rc is not None, f"No runtime configuration found for runtime type {self.name} in OS builder {os_builder.get_name()}"
+    #     # q, missed = aws_utils.remap_for_image_query(rc)
+    #     # kv = aws_utils.query_image(
+    #     #         query=q,
+    #     #         post_query_filter=missed,
+    #     #         session_config=self.model.self_to_aws_client_config(),
+    #     #     )
+
+    #     kv = os_builder.get_runtime_config_query_results(self)
+    #     if kv:
+    #         ret = image_from_query_result(   # stage 24: that function is gone; see aws_utilskv, os_builder, self)
+    #     return ret
+
+    def query_images(self, series: list[str]) -> list[dict[str, Any]]:
+        """Every AMI we own that carries a ``csis_series`` tag (read-only)."""
+        from cs_image_system.base.lineage import TAG_PREFIX
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        out: list[dict[str, Any]] = []
+        paginator = ec2.get_paginator("describe_images")
+        for page in paginator.paginate(Owners=["self"],
+                                       Filters=[{"Name": "tag-key", "Values": [f"{TAG_PREFIX}series"]}]):
+            for img in page.get("Images", []):
+                tags = {t["Key"]: t["Value"] for t in img.get("Tags", []) if "Key" in t}
+                out.append({"image_id": img.get("ImageId"), "name": img.get("Name"),
+                            "state": img.get("State"), "created": img.get("CreationDate"),
+                            "tags": tags})
+        return out
+
+    # ----------------------------------------------- AWS parity (stage 11.1)
+    def _ours(self, instances: list[dict[str, Any]]) -> list[dict[str, Any]]:
+        """Stage 93: of the machines found by Name, the ones this
+        configuration may take for its own -- tagged with its id, or with no
+        id at all (launched before the stage). Another configuration's
+        machine of the same name is not ours to read, stop or log into."""
+        from cs_image_system.base.lineage import ours_or_unlabelled
+        ctx = self._get_context()
+        return [i for i in instances
+                if ours_or_unlabelled(ctx, {t["Key"]: t["Value"] for t in i.get("Tags", []) if "Key" in t})]
+
+    def instance_tags(self, instance_name: str) -> dict[str, str] | None:
+        """The tags the named machine carries (stage 93's relabel reads them);
+        None when no such machine stands."""
+        inst = self._named_instance(instance_name)
+        if inst is None:
+            return None
+        return {t["Key"]: t["Value"] for t in inst.get("Tags", []) if "Key" in t}
+
+    def retag_instance(self, instance_name: str, tags: dict[str, str]) -> bool:
+        """``create-tags`` on the named machine (stage 93: the id, in place)."""
+        inst = self._named_instance(instance_name)
+        if inst is None or not inst.get("InstanceId"):
+            return False
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        ec2.create_tags(Resources=[str(inst["InstanceId"])], Tags=[{"Key": k, "Value": str(v)} for k, v in tags.items()])
+        return True
+
+    def _running_instance(self, instance_name: str) -> dict[str, Any] | None:
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        res = ec2.describe_instances(Filters=[{"Name": "tag:Name", "Values": [instance_name]},
+                                              {"Name": "instance-state-name", "Values": ["pending", "running"]}])
+        found = self._ours([i for r in res.get("Reservations", []) for i in r.get("Instances", [])])
+        return found[0] if found else None
+
+    def can_query_instance_boot_image(self) -> bool:
+        return True
+
+    def query_instance_boot_image(self, instance_name: str) -> str | None:
+        """The AMI the named instance runs (its ``ImageId``); None when no
+        such instance is running -- read-only, never fatal."""
+        try:
+            inst = self._running_instance(instance_name)
+            return str(inst.get("ImageId")) if inst and inst.get("ImageId") else None
+        except Exception as e:  # noqa: BLE001 - read-only probe
+            log.debug(f"AWS runtime {self.get_name()}: boot image of {instance_name!r} unavailable: {e}")
+            return None
+
+    # ------------------------------------------------ power state (stage 57)
+    #: EC2 ``State.Name`` mapped onto the system's vocabulary. The mapping
+    #: lives here because this is where the cloud knowledge belongs; nothing
+    #: outside this plugin sees an EC2 spelling. Note ``terminated``: the
+    #: record lingers in describe_instances for about an hour after the
+    #: machine is gone, and a lingering record is not a machine.
+    _EC2_POWER = {
+        "pending": power_state.STARTING,
+        "running": power_state.RUNNING,
+        "stopping": power_state.STOPPING,
+        "stopped": power_state.STOPPED,
+        "shutting-down": power_state.STOPPING,
+        "terminated": power_state.ABSENT,
+    }
+
+    def _named_instance(self, instance_name: str) -> dict[str, Any] | None:
+        """The instance with this Name tag WHATEVER its state -- unlike
+        ``_running_instance``, which filters on pending/running and so cannot
+        see a machine that is merely switched off. A terminated record is
+        used only when there is nothing else, since AWS keeps it visible for
+        about an hour after the machine has gone."""
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        res = ec2.describe_instances(Filters=[{"Name": "tag:Name", "Values": [instance_name]}])
+        found = self._ours([i for r in res.get("Reservations", []) for i in r.get("Instances", [])])
+        if not found:
+            return None
+        live = [i for i in found
+                if str((i.get("State") or {}).get("Name")) != "terminated"]
+        return (live or found)[0]
+
+    def can_query_instance_power_state(self) -> bool:
+        return True
+
+    def query_instance_power_state(self, instance_name: str) -> str | None:
+        """EC2's own ``State.Name`` for the named instance. None means this
+        runtime could not find out (credentials, network, permissions) --
+        never that the machine is off; a machine that is off answers
+        ``STOPPED``."""
+        try:
+            inst = self._named_instance(instance_name)
+            if inst is None:
+                return power_state.ABSENT
+            raw = str((inst.get("State") or {}).get("Name") or "")
+            mapped = self._EC2_POWER.get(raw)
+            if mapped is None:
+                log.warning(f"AWS runtime {self.get_name()}: instance {instance_name!r} reports "
+                            f"unrecognised state {raw!r}; treating it as unknown")
+                return power_state.UNKNOWN
+            return mapped
+        except Exception as e:  # noqa: BLE001 - read-only probe: unavailable, never fatal
+            log.debug(f"AWS runtime {self.get_name()}: power state of {instance_name!r} unavailable: {e}")
+            return None
+
+    def can_query_instance_identity(self) -> bool:
+        return True
+
+    def query_instance_identity(self, instance_name: str) -> dict[str, str] | None:
+        """``InstanceId`` and ``PrivateDnsName`` of the named instance,
+        whatever its power state (stage 58) -- ``_named_instance`` sees a
+        stopped machine, ``_running_instance`` does not."""
+        try:
+            inst = self._named_instance(instance_name)
+            if inst is None or not inst.get("InstanceId"):
+                return None
+            return {"instance_id": str(inst["InstanceId"]),
+                    "provider_hostname": str(inst.get("PrivateDnsName") or "")}
+        except Exception as e:  # noqa: BLE001 - read-only probe
+            log.debug(f"AWS runtime {self.get_name()}: identity of {instance_name!r} unavailable: {e}")
+            return None
+
+    def can_set_instance_power_state(self) -> bool:
+        return True
+
+    def start_instance(self, instance_name: str, timeout: int = 300) -> bool:
+        inst = self._named_instance(instance_name)
+        if inst is None:
+            raise RuntimeError(f"AWS runtime {self.get_name()}: no instance named {instance_name!r} to start")
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        iid = str(inst["InstanceId"])
+        ec2.start_instances(InstanceIds=[iid])
+        ec2.get_waiter("instance_running").wait(
+            InstanceIds=[iid], WaiterConfig={"Delay": 5, "MaxAttempts": max(1, timeout // 5)})
+        return True
+
+    def stop_instance(self, instance_name: str, timeout: int = 300) -> bool:
+        inst = self._named_instance(instance_name)
+        if inst is None:
+            raise RuntimeError(f"AWS runtime {self.get_name()}: no instance named {instance_name!r} to stop")
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        iid = str(inst["InstanceId"])
+        ec2.stop_instances(InstanceIds=[iid])
+        ec2.get_waiter("instance_stopped").wait(
+            InstanceIds=[iid], WaiterConfig={"Delay": 5, "MaxAttempts": max(1, timeout // 5)})
+        return True
+
+    def dispose_image(self, build_id: str) -> bool:
+        """Deregister the AMI and delete the EBS snapshots it was made of --
+        the finding-46 shape done by hand for two AMIs on 2026-09-05.
+        Not found = already gone (the record is still dropped)."""
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        try:
+            images = ec2.describe_images(ImageIds=[build_id]).get("Images", [])
+        except Exception as e:  # noqa: BLE001
+            if "InvalidAMIID" in str(e) or "NotFound" in str(e):
+                log.warning(f"AMI {build_id} not found; nothing to deregister")
+                return False
+            raise
+        if not images:
+            log.warning(f"AMI {build_id} not found; nothing to deregister")
+            return False
+        snapshots = [m["Ebs"]["SnapshotId"] for m in images[0].get("BlockDeviceMappings", [])
+                     if m.get("Ebs", {}).get("SnapshotId")]
+        ec2.deregister_image(ImageId=build_id)
+        for snap in snapshots:
+            ec2.delete_snapshot(SnapshotId=snap)
+        log.info(f"AMI {build_id} deregistered; snapshots deleted: {snapshots or 'none'}")
+        return True
+
+    def verify_instance(self, instance_name: str, expected_build: str | None = None,
+                        expect_mounts: int = 0, timeout: int = 600,
+                        mount_points: list[str] | None = None) -> dict[str, Any]:
+        """Over SSM: the launch parameters' completion marker
+        (/var/lib/csis/launch-applied, written as the user-data script's
+        last act), the mounts under /mnt, and the AMI the instance runs.
+        ``mount_points`` is accepted for the contract; the count over SSM is
+        this runtime's reading (hygiene XII item 22 was GCE's console)."""
+        import time  # noqa: PLC0415
+        checks: list[dict[str, Any]] = []
+        deadline = time.time() + timeout
+        script = ("test -f /var/lib/csis/launch-applied && echo LAUNCH_APPLIED; "
+                  "findmnt -rn -o TARGET | grep -c '^/mnt/' || true")
+        out, rc = "", 1
+        while True:
+            try:
+                rc, out = self.run_session_command(instance_name, script, timeout=120)
+            except Exception as e:  # noqa: BLE001 - SSM not up yet
+                rc, out = 1, str(e)
+            if rc == 0 and "LAUNCH_APPLIED" in out:
+                break
+            if time.time() >= deadline:
+                break
+            time.sleep(15)
+        applied = rc == 0 and "LAUNCH_APPLIED" in out
+        checks.append({"name": "startup scripts", "ok": applied,
+                       "detail": "launch parameters applied" if applied else f"no completion marker within {timeout}s"})
+        booted = self.query_instance_boot_image(instance_name)
+        if expected_build:
+            checks.append({"name": "booted image", "ok": booted == expected_build,
+                           "detail": f"booted {booted}, expected {expected_build}"})
+        else:
+            checks.append({"name": "booted image", "ok": booted is not None, "detail": f"booted {booted}"})
+        if expect_mounts:
+            try:
+                mounted = int([ln for ln in out.splitlines() if ln.strip().isdigit()][-1])
+            except (IndexError, ValueError):
+                mounted = 0
+            checks.append({"name": "data disks mounted", "ok": mounted >= expect_mounts,
+                           "detail": f"{mounted} mount(s) under /mnt, {expect_mounts} declared"})
+        return {"ok": all(c["ok"] for c in checks), "checks": checks, "evidence": out.splitlines()[-20:]}
+
+    def running_instance_id(self, instance_name: str) -> str | None:
+        """The id of the RUNNING instance whose Name tag is ``instance_name``."""
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        res = ec2.describe_instances(Filters=[{"Name": "tag:Name", "Values": [instance_name]},
+                                              {"Name": "instance-state-name", "Values": ["running"]}])
+        ids = [i["InstanceId"] for i in self._ours([i for r in res.get("Reservations", []) for i in r.get("Instances", [])])]
+        return ids[0] if ids else None
+
+    def ssh_proxy_command(self, instance_name: str) -> list[str] | None:
+        """SSH over Session Manager (``AWS-StartSSHSession``): the instance's
+        SSM agent holds an outbound connection, so a machine in a private
+        subnet with no public address is reached with no inbound rule. The
+        path packer bakes through in this account; the caller needs
+        ``ssm:StartSession`` on the instance and the document, and the
+        session-manager plugin beside the aws CLI."""
+        instance_id = self.running_instance_id(instance_name)
+        if instance_id is None:
+            return None
+        cmd = ["aws", "ssm", "start-session", "--target", instance_id, "--document-name", "AWS-StartSSHSession",
+               "--parameters", "portNumber=%p", "--region", str(self.model.get_region())]
+        profile = self.model.get_credentials().get("profile_name")
+        return cmd + (["--profile", str(profile)] if profile else [])
+
+    def run_session_command(self, instance_name: str, script: str, timeout: int = 300) -> tuple[int, str]:
+        """SSM ``AWS-RunShellScript`` on the instance named by its Name tag
+        (the session mechanism instances are reached by, stage 1)."""
+        import time  # noqa: PLC0415
+        cfg = self.model.self_to_aws_client_config()
+        ec2 = aws_utils.ec2_client(cfg)
+        res = ec2.describe_instances(Filters=[{"Name": "tag:Name", "Values": [instance_name]},
+                                              {"Name": "instance-state-name", "Values": ["running"]}])
+        ids = [i["InstanceId"] for i in self._ours([i for r in res.get("Reservations", []) for i in r.get("Instances", [])])]
+        if not ids:
+            # stage 57: say WHICH failure this is. A machine the operator
+            # switched off is not a machine that was never there, and
+            # "no running instance" read as the latter for both.
+            state = self.query_instance_power_state(instance_name)
+            raise RuntimeError(f"AWS runtime {self.get_name()}: cannot run a command on "
+                               f"{instance_name!r}: it is {power_state.describe(state)}")
+        ssm = aws_utils.aws_client("ssm", cfg)
+        sent = ssm.send_command(InstanceIds=ids[:1], DocumentName="AWS-RunShellScript",
+                                Parameters={"commands": script.splitlines()}, TimeoutSeconds=timeout)
+        command_id = sent["Command"]["CommandId"]
+        deadline = time.time() + timeout
+        while True:
+            try:
+                inv = ssm.get_command_invocation(CommandId=command_id, InstanceId=ids[0])
+            except Exception as e:  # noqa: BLE001
+                # the invocation record appears a moment AFTER send_command
+                # returns (found live, ledger 72: the unmount had already run
+                # on the instance when this raised, so no receipt was written)
+                code = str(getattr(e, "response", {}).get("Error", {}).get("Code", "")) if hasattr(e, "response") else ""
+                if code == "InvocationDoesNotExist" and time.time() < deadline:
+                    time.sleep(2)
+                    continue
+                raise
+            status = inv.get("Status")
+            if status in ("Success", "Failed", "TimedOut", "Cancelled"):
+                out = (inv.get("StandardOutputContent") or "") + (inv.get("StandardErrorContent") or "")
+                return (0 if status == "Success" else 1), out
+            if time.time() > deadline:
+                return 1, f"ssm command {command_id} still {status} after {timeout}s"
+            time.sleep(5)
+
+    def retag_image(self, image_id: str, tags: dict[str, str]) -> bool:
+        """``create-tags`` on one of our own AMIs (zero-drift-report)."""
+        ec2 = aws_utils.ec2_client(self.model.self_to_aws_client_config())
+        ec2.create_tags(Resources=[image_id],
+                        Tags=[{"Key": k, "Value": str(v)} for k, v in sorted(tags.items())])
+        return True
+
+    # ------------------------------------------------- packer source hooks
+    def packer_source_type(self) -> str:
+        from .aws_packer_source import AMAZON_EBS
+        return AMAZON_EBS
+
+    def packer_source_blocks(self, image: Any, *, runtime: str, source_type: str, subconfig: Any,
+                             self_subconfig: Any, psi: Any, tags: dict[str, str],
+                             final_name: str, pinned: str | None) -> list[str]:
+        from .aws_packer_source import amazon_ebs_source
+        return amazon_ebs_source(self.model, image, runtime=runtime, source_type=source_type,
+                                 subconfig=subconfig, self_subconfig=self_subconfig, psi=psi,
+                                 tags=tags, final_name=final_name, pinned=pinned)
+
+    def generate_items_during(self, phase: ExecutionLifecyclePhase) -> AssetSet:
+        return super().generate_items_during(phase)
+
+    # ------------------------------------------------------------ V2 (N9)
+    SSM = "ssm"
+
+    def session_mechanism(self) -> str | None:
+        mech = getattr(self.model, "session_mechanism", None)
+        if not mech:
+            return None
+        mech = str(mech).strip().lower()
+        if mech != self.SSM:
+            raise ValueError(f"AWS runtime {self.get_name()}: unknown session mechanism {mech!r} "
+                             f"(supported: {self.SSM})")
+        return mech
+
+    def session_agent_commands(self, os_family: str | None = None) -> list[str]:
+        if self.session_mechanism() != self.SSM:
+            return []
+        fam = (os_family or "").lower()
+        region = self.model.get_region()
+        if fam in ("debian", "ubuntu"):
+            # Guarded: the SSM-communicator bootstrap has usually installed the
+            # agent already (and owns /tmp/ssm.deb as root -- found live:
+            # curl(23) on re-download); unique filename, root-owned download.
+            install = ["command -v amazon-ssm-agent >/dev/null 2>&1 || snap list amazon-ssm-agent >/dev/null 2>&1 || "
+                       f"(sudo curl -fsSL https://s3.{region}.amazonaws.com/amazon-ssm-{region}/latest/debian_amd64/amazon-ssm-agent.deb -o /tmp/ssm-agent-bake.deb && sudo dpkg -i /tmp/ssm-agent-bake.deb)"]
+        else:
+            install = [f"sudo yum install -y https://s3.{region}.amazonaws.com/amazon-ssm-{region}/latest/linux_amd64/amazon-ssm-agent.rpm || sudo yum install -y amazon-ssm-agent"]
+        return [f"# session mechanism 'ssm' ({self.get_name()}): SSM agent for debug sessions"] + install + [
+            "sudo systemctl enable amazon-ssm-agent"]
+
+    #: stage 86: how long a bake waits for Systems Manager to leave a new
+    #: machine alone -- quiet for QUIET checks in a row, STEP seconds apart;
+    #: never judged before the machine is MIN_AGE seconds old (the
+    #: associations start about forty seconds after launch); LIMIT at most.
+    SETTLE_QUIET_CHECKS = 3
+    SETTLE_STEP_SECONDS = 10
+    SETTLE_MIN_AGE_SECONDS = 90
+    SETTLE_LIMIT_SECONDS = 600
+
+    def bake_settle_commands(self, os_family: str | None = None) -> list[str]:
+        """An account's Systems Manager may hold associations that target
+        EVERY instance (Quick Setup's host management: the agent's update,
+        a patch scan, inventory). They run on a build machine the moment its
+        agent registers, as documents under ``ssm-document-worker`` and, for
+        the agent's own update, a detached updater -- and they use the
+        package database while the bake does (found walking the daily
+        driver, stage 65, finding F29). The brackets keep the search from
+        finding itself in the process list."""
+        if self.session_mechanism() != self.SSM:
+            return []
+        quiet, step = self.SETTLE_QUIET_CHECKS, self.SETTLE_STEP_SECONDS
+        age, limit = self.SETTLE_MIN_AGE_SECONDS, self.SETTLE_LIMIT_SECONDS
+        return [
+            f"# session mechanism 'ssm' ({self.get_name()}): Systems Manager may act on every new machine (agent "
+            f"updates, patch scans, inventory); wait until it has been quiet for {quiet * step}s, {limit}s at most",
+            "quiet=0; waited=0",
+            f'while [ "$quiet" -lt {quiet} ] && [ "$waited" -lt {limit} ]; do '
+            f'if [ "$(cut -d. -f1 /proc/uptime)" -lt {age} ] || sudo grep -Eaqs '
+            "'ssm-document-work[e]r|amazon-ssm-agent-updat[e]r' /proc/[0-9]*/cmdline; "
+            f"then quiet=0; else quiet=$((quiet + 1)); fi; sleep {step}; waited=$((waited + {step})); done",
+            f'if [ "$quiet" -lt {quiet} ]; then echo "csis: Systems Manager was still acting on this machine after '
+            '$waited seconds; going on (a package step waits out a held database)"; '
+            'else echo "csis: Systems Manager is quiet on this machine (waited $waited seconds)"; fi',
+        ]
+
+    def session_verify_commands(self, os_family: str | None = None) -> list[str]:
+        if self.session_mechanism() != self.SSM:
+            return []
+        return ["# verify: SSM agent baked",
+                "command -v amazon-ssm-agent >/dev/null 2>&1 || test -x /usr/bin/amazon-ssm-agent || snap list amazon-ssm-agent >/dev/null 2>&1",
+                "systemctl is-enabled amazon-ssm-agent >/dev/null 2>&1 || systemctl is-enabled snap.amazon-ssm-agent.amazon-ssm-agent.service >/dev/null 2>&1"]
+
+    def release_commands(self, build_id: str, tags: dict[str, str]):
+        """Mark a released AMI in the cloud: tag it (reviewable, gated by
+        config.apply_release)."""
+        from cs_image_system.base.models.executable import ExecutableModel
+        args = ["ec2", "create-tags", "--region", str(self.model.get_region()), "--resources", build_id, "--tags"]
+        args += [f"Key={k},Value={v}" for k, v in sorted(tags.items())]
+        creds = self.model.get_credentials()        # stage 17
+        if creds.get("profile_name"):
+            args += ["--profile", str(creds["profile_name"])]
+        e = ExecutableModel(name="aws", type_="executable", binary="aws")
+        e.args = args
+        return [e]
+
+    def default_bake_user(self, family: str) -> str | None:
+        """The vendor AMI's default user: the only account whose
+        authorized_keys receives packer's temporary key (found live: a
+        Debian-derived image baked as 'ec2-user' never authenticates)."""
+        return {"debian": "admin", "ubuntu": "ubuntu"}.get((family or "").lower(), "ec2-user")
+
+    def session_instance_profile(self) -> str | None:
+        if self.session_mechanism() != self.SSM:
+            return None
+        return getattr(self.model, "session_instance_profile", None) or None
+
+
+class AwsCLIVersionChecker(AbstractVersionChecker):
+    """Version checker for AWS."""
+
+    @classmethod
+    def csis_name(cls) -> str:
+        return AWS_CLI
+
+
+    @classmethod
+    def csis_classifier(cls) -> VCT:
+        return VCT.VERSION_CHECKER
+    
+    def get_regex(self) -> str:
+        return r"aws-cli\/([\d\.]+)\s"