# Build a hardened golden machine image with Packer

A Packer HCL2 template, unattended install config, and pipeline plan for reproducible, hardened VM or cloud images.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Design, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/build-a-hardened-golden-machine-image-with-packer

## Prompt

```text
Help me build a reproducible "golden" machine image with HashiCorp Packer.

**Target platforms:** [e.g. AWS AMI, Azure, GCP, VMware vSphere, Proxmox]
**Base OS and version:** [e.g. Ubuntu 24.04, RHEL 9, Windows Server 2022]
**Install method:** [cloud base image / ISO with unattended install: autoinstall, preseed, Kickstart, or Autounattend.xml]
**What the image must include:** [packages, agents, users, config]
**Hardening standard:** [e.g. CIS Level 1, internal baseline, none yet]
**Provisioner preference:** [shell, PowerShell, Ansible]
**Day-0 customization:** [cloud-init / cloudbase-init needs]
**Build pipeline:** [where builds run, e.g. GitHub Actions, GitLab CI, Jenkins]

Produce:
1. A Packer HCL2 template split into sensible files (plugins block with pinned versions, variables with descriptions, sources, build).
2. The unattended install file for my OS, if building from ISO.
3. Provisioning steps in order: updates, packages, hardening, cleanup (remove SSH host keys, machine-id, logs, cloud-init state, temporary credentials) so every instance boots unique.
4. Secrets handling: no passwords or keys in the template; use environment variables or a secrets manager.
5. Validation: packer validate, a smoke test of the built image, and how to tag images with version, date, and source commit.
6. A CI pipeline outline for scheduled rebuilds and image retirement.

Point out common failure points (boot command timing, WinRM/SSH communicator timeouts, cloud-init running twice). Mark any plugin option you are unsure of as [VERIFY IN PLUGIN DOCS].
```

## What to fill in

- e.g. AWS AMI, Azure, GCP, VMware vSphere, Proxmox
- e.g. Ubuntu 24.04, RHEL 9, Windows Server 2022
- packages, agents, users, config
- e.g. CIS Level 1, internal baseline, none yet
- shell, PowerShell, Ansible
- cloud-init / cloudbase-init needs
- where builds run, e.g. GitHub Actions, GitLab CI, Jenkins
- VERIFY IN PLUGIN DOCS

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.