Skip to main content

Install Linux Agent Using an AMI Created with Packer

You can use HashiCorp Packer to create a machine image with the Lacework agent pre-installed and configured. To learn more about HashiCorp Packer, see the Packer documentation.

Example Packer Template

The following example Packer template creates a machine image by remotely uploading and executing the Lacework ‘’ script on a staging instance before making the machine image available in your cloud console. You can customize the template for your environment or automate an alternative installation method using Packer.

For an overview of the Lacework agent installation script, see Lacework for Workload Security.

The following example template creates an Amazon Linux 2 AMI with the Lacework agent installed and running.

  "variables": {
    "aws_access_key": "{{env `AWS_ACCESS_KEY_ID`}}",
    "aws_secret_key": "{{env `AWS_SECRET_ACCESS_KEY`}}",
    "lacework_token": "{{env `LACEWORK_TOKEN`}}"
  "builders": [
      "type": "amazon-ebs",
      "access_key": "{{user `aws_access_key`}}",
      "secret_key": "{{user `aws_secret_key`}}",
      "region": "us-east-1",
      "source_ami_filter": {
      "filters": {
      "virtualization-type": "hvm",
      "name": "amzn2-ami-hvm-*",
      "root-device-type": "ebs"
      "owners": ["amazon"],
      "most_recent": true
      "instance_type": "t2.micro",
      "ssh_username": "ec2-user",
      "ami_name": "lacework {{timestamp}}"
  "provisioners": [
      "type": "shell",
      "inline": ["curl -sSL | sudo bash -s -- {{user `lacework_token`}} -U Your_API_Endpoint"]

To use this template:

  1. Install Packer.

  2. Create a template file called lacework.json.

  3. Add your credentials as environment variables.


    You can find your Lacework Agent Access Token in the Lacework Console at Settings > Configuration > Agents. You can find and inspect the script in the same location under Install Options.

  4. Run Packer:

    packer build lacework.json
  5. In the AWS AMI console, an AMI named ‘lacework TIMESTAMP’ is displayed and ready for use.


The datacollector install script is idempotent.