Use the Conformity Knowledge Base AI to help improve your Cloud Posture

AMI Naming Conventions

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Low (generally tolerable level of risk)
Rule ID: EC2-037

Ensure that all your Amazon Machine Images (AMIs) are using suitable naming conventions for tagging in order to manage them more efficiently and adhere to AWS resource tagging best practices. A naming convention is a well-defined set of rules useful for choosing the name of an AWS resource. Cloud Conformity strongly recommends using the following pattern (default) for naming your AWS AMIs: **^ami-(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1)-(d|t|s|p)-([a-z0-9\\-]+)$**. In case you need to create your custom naming pattern, the default one can be easily replaced within the rule settings available on Cloud Conformity console.

This rule can help you with the following compliance standards:

  • APRA
  • MAS

For further details on compliance standards supported by Conformity, see here.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Security

Naming (tagging) your AWS AMIs logically and consistently has several advantages such as providing additional information about the image location and usage, promoting consistency within the selected environment, distinguishing fast similar resources from one another, avoiding naming collisions, improving clarity in cases of potential ambiguity and enhancing the aesthetic and professional appearance.


Default Pattern Format

ami-RegionCode-EnvironmentCode-ApplicationCode

Default Pattern Components

RegionCode
(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1) for us-east-1, us-west-1, us-west-2, eu-west-1, eu-central-1, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, sa-east-1.
EnvironmentCode
(d|t|s|p) for development, test, staging, production.
ApplicationCode
([a-z0-9\-]+) for applications (e.g. apache-spark, tomcat) installed on the AMIs.

Default Pattern Examples

ami-us-west-2-p-nodejs
ami-us-west-1-p-apache-spark

Audit

To verify the naming conventions used for tagging your Amazon Machine Images, perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, under IMAGES section, choose AMIs.

04 Open the dashboard Show/Hide Columns dialog box by clicking the configuration icon: http://goo.gl/REnVAP.

05 Inside the Show/Hide Columns dialog box, under Your Tag Keys column, select the Name checkbox then click Close to return to the AMI dashboard.

06 Under Name column, check the name tag value (e.g. http://goo.gl/pyn4Xp) of each image created in the current AWS region. If one or more AMIs are not using naming conventions based on the Cloud Conformity default pattern (i.e. ^ami-(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1)-(d|t|s|p)-([a-z0-9\-]+)$) or based on a well-defined custom pattern, the naming structure of these resources does not adhere to AWS tagging best practices.

07 Change the AWS region from the navigation bar and repeat the audit process for other regions.

Using AWS CLI

01 Run describe-images command (OSX/Linux/UNIX) using custom query filters to list the name tags values of the AMIs created in the selected AWS region:

aws ec2 describe-images
  --region us-east-1
  --owners self
  --output table
  --query 'Images[*].Tags'

02 The command output should return an empty table if the available images do not have name tags defined or a populated table if the images have already name tags defined, as shown in the following example:

-------------------------------
|       DescribeImages        |
+-------+---------------------+
|  Key  |        Value        |
+-------+---------------------+
|  Name |  NginxWebServerAMI  |
|  Name |  MyWebAppAPIAMI     |
+-------+---------------------+

If the names returned in the Value table column do not follow any recommended naming conventions, the naming (tagging) structure of the specified AMIs does not adhere to AWS tagging best practices.

03 Change the AWS region by updating the --region command parameter value and repeat step no. 1 and 2 to perform the audit process for other regions.

Remediation / Resolution

To implement the appropriate naming convention for tagging your existing AWS AMIs based on the default pattern (i.e. ^ami-(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1)-(d|t|s|p)-([a-z0-9\-]+)$), perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under IMAGES section, choose AMIs.

04 Select the AMI that you want to retag.

05 Select Tabs tab from the dashboard bottom panel and click the Add/Edit Tags button to add or change the resource Name tag.

06 In the Add/Edit Tags dialog box, perform the following actions:

  1. If the selected image does not have a Name tag defined, click Create Tag button and provide the following information:
    • In the Key box type Name as the key name.
    • In the Value box enter a value for the Name tag, value that must be defined based on Cloud Conformity pattern, e.g. ami-us-east-1-p-nodejs.
  2. If the selected image does have a Name tag already defined, change the tag value available in the Value box with one that follows the Cloud Conformity default pattern, e.g. ami-us-east-1-p-nodejs.
  3. Click Save to apply the changes. The selected Amazon Machine Image is now tagged using an appropriate naming convention.

07 Repeat steps 4 – 6 to rename (retag) other AWS AMIs that require a valid naming convention, available in the current region.

08 Change the AWS region from the navigation bar and repeat the entire process for other regions.

Using AWS CLI

01 Run describe-images command (OSX/Linux/UNIX) using custom filters to list the IDs of the AMIs tagged without using an appropriate naming convention (see Audit section part II to identify the invalid Name tag values). The following command example expose the ID of an AWS AMI tagged with Name=NginxWebServerAMI, available in the US East-1 region:

aws ec2 describe-images
  --region us-east-1
  --filters "Name=tag:Name,Values=NginxWebServerAMI"
  --query 'Images[*].ImageId'

02 The command output should return the ID of the image identified by the Name tag value:

[
	"ami-67bbcf70"
]

03 Run create-tags command (OSX/Linux/UNIX) using the image ID returned at the previous step as identifier to add or overwrite the Name tag value for the specified AWS AMI. The following command example overwrites the Name tag value of an AMI with the ID ami-67bbcf70, created in the US East-1 region. The tag value used, i.e. ami-us-east-1-p-apache-spark, follows a well-defined naming convention based on the Cloud Conformity recommended pattern (the command does not return an output):

aws ec2 create-tags
  --region us-east-1
  --resources ami-67bbcf70
  --tags Key=Name,Value=ami-us-east-1-p-apache-spark

04 Repeat steps no. 1 - 3 to retag other images that require a valid naming convention, available in the current region.

05 Repeat steps no. 1 - 4 to implement the entire process for other AWS regions.

References

Publication date Sep 8, 2016