From b12fa3be49d14d3801dd9b88a3d6ce8893eb76a0 Mon Sep 17 00:00:00 2001
From: Brian Ojeda <9335829+sgtoj@users.noreply.github.com>
Date: Tue, 16 Jun 2026 16:22:12 -0400
Subject: [PATCH] feat: support resolve: prefixed ami for launch-time
 resolution

adds an optional ami variable accepting an explicit ami-* id or a
resolve:ssm:* reference. when set, the value is passed through to the
launch template so ec2 resolves the ami at instance launch time rather
than at apply time. defaults to the apply-time ssm lookup when empty.
---
 main.tf      |  4 +++-
 variables.tf | 11 +++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/main.tf b/main.tf
index 3886e52..bdd8392 100644
--- a/main.tf
+++ b/main.tf
@@ -27,6 +27,8 @@ locals {
     enabled          = var.ssm_sessions.enabled
     logs_bucket_name = try(coalesce(var.ssm_sessions.logs_bucket_name, var.logs_bucket_name), "")
   }
+
+  image_id = var.ami != "" ? var.ami : data.aws_ssm_parameter.linux_ami.value
 }
 
 data "aws_partition" "current" {}
@@ -37,7 +39,7 @@ module "proxy" {
   source  = "cloudposse/ec2-autoscale-group/aws"
   version = "0.41.1"
 
-  image_id                = data.aws_ssm_parameter.linux_ami.value
+  image_id                = local.image_id
   instance_type           = "t3.nano"
   health_check_type       = "ELB"
   user_data_base64        = base64encode(module.this.enabled ? data.cloudinit_config.this[0].rendered : "")
diff --git a/variables.tf b/variables.tf
index aee9387..19f6598 100644
--- a/variables.tf
+++ b/variables.tf
@@ -27,6 +27,17 @@ variable "capacity" {
   default     = {}
 }
 
+variable "ami" {
+  type        = string
+  description = "AMI ID to launch instances with. Accepts an explicit `ami-*` ID or a `resolve:ssm:*` reference that EC2 resolves at instance launch time. Defaults to the latest Amazon Linux 2023 AMI resolved at apply time when empty."
+  default     = ""
+
+  validation {
+    condition     = var.ami == "" || startswith(var.ami, "ami-") || startswith(var.ami, "resolve:")
+    error_message = "The ami value must be empty, an explicit `ami-*` ID, or a `resolve:*` reference."
+  }
+}
+
 variable "instance_types" {
   type = list(object({
     type   = string