EC2 Image Builder FAQs

New images can be configured to be generated based on triggers such as every time there is a pending update (e.g., source AMI updates, security updates, updates to compliance, new tests, etc.) or at a stipulated time cadence. You can specify a “build cadence” at which new golden images are produced with the latest changes by applying pending changes. The latest images can be tested with the Image Builder to validate your applications on the updated builds. You can also subscribe to notifications via SNS queues for pending updates to images built with the Image Builder. You can use these notifications as triggers to build new images.

You can customize software images from registered software sources such as RPM/Debian package repositories and MSIs and custom installers on Windows. In addition to pre-registered AWS software sources, you can also register one or more of your repositories and Amazon S3 locations that contain software for installation. You can provide installer-specific “unattend” mechanisms (such as answers files) for installation workflows that need interactive input.

Image Builder allows you to define collections of security settings that you can edit, update, and use to harden your images built using Image Builder. These settings collections can be applied towards meeting applicable compliance criteria. These criteria may be mandated by your organization or by the regulatory authority in your industry. AWS provides a gallery of settings to help meet popular industry regulations. You can apply collections of settings directly or in a modified form. For example, AWS-provided settings for STIG closes non-essential open ports, and enables a software firewall.

No, the collections of settings from AWS represent recommended guidance towards achieving compliance and do not guarantee compliance. You will need to work with your compliance teams and auditors to validate compliance. The settings provided by AWS can be modified based on your needs and saved for reuse in the gallery.

Collections of settings can be authored from scratch or derived from AWS-provided templates and stored in a registered Amazon S3 location. You can build your own collections that apply security settings such as ensuring security patches are applied, installing firewall, closing certain ports, not allowing file sharing among programs, installing anti-malware, creating strong passwords, keeping a backup, using encryption when possible, disabling weak encryption, logging/audit controls, removal of personal data, etc. You can add your custom settings to the gallery.

The test framework in the Image Builder lets you catch incompatibilities introduced by OS updates before deployment to AWS regions. You can run both - AWS-provided tests and your own tests, manage test runs, results, and gate downstream operations on the passing of tests. Examples of AWS-provided tests include: testing if an AMI can boot to the login prompt, testing if an AMI can run a sample app, etc. You can also run your own tests on the images.

Each test in Image Builder consists of a test script, a test binary, and test metadata. The test script contains orchestration commands to kick off the test binary that can be written in any language and in any test framework supported by in the OS (e.g., PowerShell on Windows and bash, python, ruby, etc. on Linux) and exit status codes denote test outcomes. Test metadata also includes attributes such as the name, description, paths to test binary, expected duration, etc.).

Image Builder integrates with AWS Organizations to enable sharing of AMIs across AWS accounts using existing mechanisms. Image Builder can modify AMI launch permissions to control which AWS accounts besides the owner are allowed to launch EC2 VMs with the AMI (e.g., private, public, and share with specific accounts). You can also have your AWS Organization master account enforce constraints on member accounts to launch instances only with approved and compliant AMIs. See Image Builder documentation for details on integration with AWS Organizations.

Image Builder uses Amazon ECR (a managed service for container registries) as both an input and output for container images. You can configure policies to manage permissions for each repository and restrict access to IAM users, roles, or AWS accounts. ECR integrates with RAM and AWS Organizations to allow the sharing, distribution, and replication of container images across regions and accounts. ECR uses IAM policies for controlling access to resources.

Image Builder can copy AMIs to selected AWS regions using existing AMI sharing mechanisms. The distribution can be gated on the passing of tests with Image Builder.

The Image Builder can integrate with AWS CI/CD services such as Code Build and Code Pipeline to help actualize an end-to-end CI/CD pipeline for building, testing, and deploying AMIs.

Image Builder tracks and displays the progress for each step in the image building process. In addition, Image Builder can be made to emits logs to CloudWatch. For advanced troubleshooting, you can run arbitrary commands and scripts using the SSM runCommand interface.