Run the box through an apt-get update && apt-get upgrade on build?

[konklone]

Downsides: the resulting AMI ends up in a non-deterministic state from build to build.

Upsides: the resulting AMI always has up to date packages, including security-relevant ones like openssl.

Thoughts?

[jzonthemtn]

Is it bad practice to execute these commands in the user-data of an instance using the resulting AMI?

[ozzyjohnson]

@jzonthemtn - I wouldn't say it's bad practice, just be sure you're aware of the impacts.

The big ones being:

• Resulting instances will non-deterministic as each instance will be running the latest packages at the time it was launched.
• Addition of a remote dependency for launch.
• Additional time to launch.

All three work against the benefits of 'baking' an AMI in the first place.

[jzonthemtn]

Thanks, @ozzyjohnson!