ORFMI - Open Rainforest Machine Image
A Python CLI tool for creating AWS AMIs from configuration files and setup scripts.
Installation
pip install orfmi
Usage
Using a Configuration File
orfmi --config-file config.yml --setup-file setup.sh
Using CLI Flags
orfmi --ami-name my-ami \
--region us-east-1 \
--source-ami "debian-12-*" \
--subnet-ids subnet-12345 subnet-67890 \
--instance-types t3.micro t3.small \
--setup-file setup.sh
Arguments
Required (one of)
Either use --config-file OR provide all individual flags:
--config-file FILE- Path to the YAML configuration file--ami-name NAME- Name for the created AMI--region REGION- AWS region--source-ami AMI_ID- Source AMI name pattern--subnet-ids SUBNET [SUBNET ...]- Subnet IDs for instance launch--instance-types TYPE [TYPE ...]- Instance types to try
Always Required
--setup-file FILE- Path to the setup script (bash or PowerShell)
Optional
--purchase-type TYPE- Purchase type:on-demandorspot--max-retries N- Maximum retries on capacity errors (default: 3)--extra-files FILE [FILE ...]- Additional files to upload-v, --verbose- Enable verbose output-q, --quiet- Suppress output except for errors and the final AMI ID
Configuration File
The configuration file is a YAML file with the following structure:
# Required fields
ami_name: my-custom-ami
region: us-east-1
source_ami: debian-12-* # AMI name pattern to search for
subnet_ids:
- subnet-12345abc
- subnet-67890def
instance_types:
- t3.micro
- t3.small
# Optional fields
ami_description: My custom AMI for production
iam_instance_profile: my-instance-profile
purchase_type: on-demand # on-demand or spot, default: on-demand
max_retries: 3 # default: 3 retries on capacity errors
ssh_username: admin # default: admin
ssh_timeout: 300 # default: 300 seconds
ssh_retries: 30 # default: 30 retries
platform: linux # linux or windows, default: linux
tags:
Name: my-ami
Environment: production
Required Fields
| Field | Description |
|---|---|
ami_name |
Name for the created AMI |
region |
AWS region |
source_ami |
Source AMI name pattern (supports wildcards) |
subnet_ids |
List of subnet IDs for launching the instance |
instance_types |
List of instance types to try (uses EC2 Fleet) |
Optional Fields
| Field | Default | Description |
|---|---|---|
ami_description |
"" |
Description for the AMI |
iam_instance_profile |
null |
IAM instance profile name |
purchase_type |
on-demand |
on-demand or spot |
max_retries |
3 |
Max retries on capacity errors |
ssh_username |
admin |
SSH username for connecting |
ssh_timeout |
300 |
SSH command timeout (seconds) |
ssh_retries |
30 |
Number of SSH connection tries |
platform |
linux |
linux or windows |
tags |
{} |
Tags to apply to resources |
Setup Script
The setup script runs on the instance to configure it before creating the AMI.
Linux (Bash)
#!/bin/bash
set -e
# Update packages
apt-get update
apt-get upgrade -y
# Install required software
apt-get install -y docker.io git
# Enable services
systemctl enable docker
# Clean up
apt-get clean
rm -rf /var/lib/apt/lists/*
Windows (PowerShell)
# Install Chocolatey
Set-ExecutionPolicy Bypass -Scope Process -Force
$url = 'https://chocolatey.org/install.ps1'
iex ((New-Object System.Net.WebClient).DownloadString($url))
# Install software
choco install -y git docker-desktop
Exit Codes
| Code | Description |
|---|---|
| 0 | Success - AMI created |
| 1 | Build failure |
| 2 | Configuration or usage error |
Output
On success, the tool outputs the AMI ID in the format:
AMI_ID=ami-0123456789abcdef0
How It Works
- Parses the configuration file or CLI arguments
- Looks up the source AMI by name pattern
- Creates temporary resources (key pair, security group, launch template)
- Launches an EC2 instance using EC2 Fleet (on-demand or spot)
- Waits for the instance to be ready
- Connects via SSH and runs the setup script
- Creates an AMI from the configured instance
- Cleans up all temporary resources
- Outputs the AMI ID
Retry Logic
The tool automatically retries on capacity errors (e.g., insufficient
capacity, instance limit exceeded) and spot instance interruptions.
Use --max-retries to configure the maximum number of retry attempts.
License
Apache License 2.0
Metadata
Release files for orfmi 20260115000944
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| orfmi-20260115000944.tar.gz | 36.0 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| orfmi-20260115000944-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 55.0 kB
Release files / orfmi-20260115000944.tar.gz
| Download URL | orfmi-20260115000944.tar.gz |
|---|---|
| Size | 36.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
5e39504975feb4bb1b42ba97124cedf1bfba513061d776b79473908fc0f11ae6
|
|
BLAKE2b-256 checksum How to use checksums |
6731dea3c88937c7399d5b0116185ff4fb8688180f166eee881e0162dc5f480c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jan 15, 2026.
Transparency logRelease files / orfmi-20260115000944-py3-none-any.whl
| Download URL | orfmi-20260115000944-py3-none-any.whl |
|---|---|
| Size | 19.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
a582b3bcc002c3356f4fe9f439413d25ab0034ba835c3587d69aa43bce9aa710
|
|
BLAKE2b-256 checksum How to use checksums |
1c448478b5edbbfce2aa2aae3b2ca801ec0aa33dbb543608f8e685cb59ee6dd7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jan 15, 2026.
Transparency logSecurity for orfmi 20260115000944
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for orfmi-20260115000944.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jan 15, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.