[obasilakis]

Part of #3004.

packer/aws/scripts/90-aws-cleanup.sh failed every AMI build from v1.0.0-aws.1. Three defects, each found on a real build in us-east-1:

1. sshd -T exits 255 (Missing privilege separation directory: /run/sshd) on Ubuntu 24.04, where ssh is socket-activated. The check read that as "password auth enabled". Fix: install -d /run/sshd first (tmpfs, not baked).
2. sshd -T | grep -q under set -o pipefail fails even when the setting is right: grep exits on the match, sshd gets SIGPIPE. Fix: capture into a variable, then grep. A failing sshd -T now reports its own error line.
3. find /var/log -path /var/log/journal -prune -o ... -delete exits 1 on GNU find (-delete implies -depth, which disables -prune), so set -e aborted the script. Fix: -print0 | xargs -0r rm -f.

Verification

• Probe instance from the same Canonical source AMI: with /run/sshd created, sshd -T rc=0 and prints passwordauthentication no; the old pipe form still failed.
• Stub test of the new check: pass on a correct config (100k lines of output), fail on yes, fail with the sshd error on rc=255. Old pipe form fails on the correct config.
• find forms run in ubuntu:24.04: old form exits 1; new form deletes *.gz / *.[0-9] outside the journal and leaves journal files untouched.
• packer build -var image_tag=v1.0.0-aws.1 with this script: === AMI cleanup checks passed ===, AMI created.

The script is a build-time step only; nothing it changes reaches a running instance's behaviour beyond what the tag already intended.

🤖 Generated with Claude Code

[vybe]

merge-train: validated READY (lane B, sole survivor of today's queue — merged individually, no train assembled). Traced all three fixes: the captured sshd -T avoids the pipefail/SIGPIPE false-fail and a non-zero exit in a || list doesn't trip set -e; -print0 | xargs -0r rm -f keeps the journal prune and removes GNU find's -delete/-prune exit 1. tests/unit/test_3004_aws_packer.py 14/14 on the head. Coverage note: those tests are source-text only; behaviour is evidenced by the real packer build in the PR body, which is the only harness this build-time script has.