AWS

Primcoat converts the hardened QCOW2 master to RAW, stages it in Amazon S3, and imports it to register an AMI. You reference the result from a launch template, an autoscaling group, or your infrastructure-as-code, exactly as you would any other AMI.

Enhanced networking (ENA) is already in the kernel of the hardened base — nothing to install — and Primcoat registers the AMI with EnaSupport so EC2 enables it. Optional AWS guest agents such as the Systems Manager agent are added during the build, before hardening, so they are scanned and signed with the rest of the image.

Publishing to more than one region

An AMI is regional. An image registered in us-east-1 cannot be launched in eu-west-1 until it has been copied there, and the copy gets a different AMI ID. You list the regions on the publish target; Primcoat registers into each one and reports the AMI ID per region.

EC2 also caps how many import tasks a region will accept at once — five by default, raisable through AWS support. Primcoat bounds its own concurrency to stay inside that limit rather than starting every region at once and having AWS reject the overflow.

One AWS-specific constraint worth knowing before you design around it: once AWS licensing has been applied to a Windows image, that image cannot be exported back out of EC2.

Naming the AMI

The AMI name comes from the template on the image definition, built from tokens like {definition}, {os}, {os_version}, {date} and {seq}. AWS accepts letters, digits, spaces and ( ) . / _ - in an AMI name, between 3 and 128 characters. Primcoat validates your template against those rules when you save the definition, so a name AWS would refuse is caught then rather than at the end of an hour-long build.

What you configure

A publish target holds the AWS account credentials, the destination regions, and the S3 bucket used for staging. You define the image name, and add version information and other details as you like.

The recommended credential setup is a cross-account IAM role rather than static keys — what Primcoat stores is a reference to a role you control, so there is nothing to rotate and you revoke access by deleting the role. See the platform overview for how that works across clouds, and security & compliance for the evidence each build produces.