Allowed AMIs Feature in Use

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console available at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, choose Dashboard to access the Amazon EC2 main dashboard.

04 In the Account attributes section, under Settings, choose Allowed AMIs.

05 In the Allowed AMIs configuration section, check the Allowed AMIs settings status. If the Allowed AMIs settings status is set to Disabled, the Allowed AMIs feature is not being used to control the discovery and utilization of Amazon Machine Images (AMIs) within the current AWS region.

06 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other AWS regions.

01 Run get-allowed-images-settings command (OSX/Linux/UNIX) with custom output filters to get the current state of the Allowed AMIs feature in the specified AWS cloud region:

aws ec2 get-allowed-images-settings
	--region us-east-1
	--query 'State'

02 The command output should return the state (status) of the Allowed AMIs feature in the selected region:

"disabled"

03 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other AWS regions.

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console available at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, choose Dashboard to access the Amazon EC2 main dashboard.

04 In the Account attributes section, under Settings, choose Allowed AMIs.

05 In the Allowed AMIs configuration section, choose Manage, and perform the following actions:

1. Set Allowed AMIs settings to Audit mode. Audit mode enables you to verify which Amazon Machine Images (AMIs) would be affected by your AMI criteria without actually restricting access, providing a risk-free evaluation period. With Audit mode, you can check for impact on expected business processes.
2. In the AMI criteria text box, configure the Allowed AMIs criteria so the approved AMIs align with your organization's security policies, compliance requirements, and operational needs, then choose Update to apply the changes. The AMI criteria is specified in JSON format. Currently, the only supported criteria is represented by the AMI providers. Valid values are: AWS aliases, AWS account IDs, and none (only your AMIs are allowed). For more details, check the AWS documentation on Allowed AMIs criteria. As an example, the following AMI criteria allows only AMIs created by AWS, AMIs created by verified providers in the AWS Marketplace, and AMIs created by an authorized AWS account identified by "123456789012":
   {
   	"ImageCriteria": [
   		{
   			"ImageProviders": [
   				"amazon",
   				"aws-marketplace",
   				"123456789012"
   			]
   		}
   	]
   }
   

3. Once you have confirmed that the AMI criteria specified in the previous step will not negatively impact expected business processes, set Allowed AMIs settings to Enabled to enable the Allowed AMIs feature in the current AWS region. Choose Update to apply the changes.

06 Change the AWS cloud region from the console navigation bar and repeat the Remediation process for other AWS regions.

01 Run enable-allowed-images-settings command (OSX/Linux/UNIX) to enable the audit mode in the specified AWS region. Audit mode allows you to verify which Amazon Machine Images (AMIs) would be affected by your AMI criteria without actually restricting access, providing a risk-free evaluation period. This allows you to check for impact on expected business processes:

aws ec2 enable-allowed-images-settings
	--region us-east-1
	--allowed-images-settings-state audit-mode

02 The command output should return the current state of the Allowed AMIs feature (i.e., "audit-mode"):

{
	"AllowedImagesSettingsState": "audit-mode"
}

03 To align with your organization's security policies, compliance requirements, and operational needs, specify the criteria that automatically filter and determine which Amazon Machine Images (AMIs) can be discovered and used in the selected AWS region. The AMI criteria is specified in JSON format. Currently, the only supported criteria is represented by the AMI providers. Valid values are: AWS aliases, AWS account IDs, and none (only your AMIs are allowed). For more details, check the AWS documentation on Allowed AMIs criteria. As an example, the following AMI criteria allows only AMIs created by AWS, AMIs created by verified providers in the AWS Marketplace, and AMIs created by an authorized AWS account identified by "123456789012". Save your AMI criteria to JSON configuration file named cc-image-criteria.json:

{
	"ImageCriteria": [
		{
			"ImageProviders": [
				"amazon",
				"aws-marketplace",
				"123456789012"
			]
		}
	]
}

04 Run replace-image-criteria-in-allowed-images-settings command (OSX/Linux/UNIX) to apply the AMI criteria defined in the previous step (i.e., cc-image-criteria.json configuration file):

aws ec2 replace-image-criteria-in-allowed-images-settings
	--region us-east-1
	--cli-input-json file://cc-image-criteria.json

05 The command output should return **true** if the request succeeds:

{
	"ReturnValue": true
}

06 Run describe-instance-image-metadata command (OSX/Linux/UNIX) to identify any Amazon EC2 instances that were launched with AMIs that don't meet your AMI criteria. This information can inform your decision on whether to update your EC2 launch configurations or CloudFormation templates to utilize approved, compliant AMIs or to modify your criteria to permit the use of these AMIs:

aws ec2 describe-instance-image-metadata
	--region us-east-1
	--query 'InstanceImageMetadata'

07 The command output should return the requested EC2 instance metadata:

[
	{
		"InstanceId": "i-0abcd1234abcd1234",
		"InstanceType": "t3.large",
		"LaunchTime": "2025-02-00T12:46:03+00:00",
		"AvailabilityZone": "us-east-1a",
		"ZoneId": "use1-az2",
		"State": {
			"Code": 16,
			"Name": "running"
		},
		"OwnerId": "123456789012",
		"ImageMetadata": {
			"ImageId": "ami-01234abcd1234abcd",
			"Name": "al2023-ami-2023.6.20250211.0-kernel-6.1-x86_64",
			"OwnerId": "137112412989",
			"State": "available",
			"ImageOwnerAlias": "amazon",
			"ImageAllowed": true,
			"IsPublic": true
		}
	},

	...

	{
		"InstanceId": "i-01234abcd1234abcd",
		"InstanceType": "t3.xlarge",
		"LaunchTime": "2025-02-00T12:46:42+00:00",
		"AvailabilityZone": "us-east-1b",
		"ZoneId": "use1-az2",
		"State": {
			"Code": 16,
			"Name": "running"
		},
		"OwnerId": "123456789012",
		"ImageMetadata": {
			"ImageId": "ami-0abcd1234abcd1234",
			"Name": "ubuntu-pro-server/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-pro-server-20250115",
			"OwnerId": "099720109477",
			"State": "available",
			"ImageOwnerAlias": "amazon",
			"ImageAllowed": true,
			"IsPublic": true
		}
	}
]

08 Once you have confirmed that the AMI criteria specified in the cc-image-criteria.json configuration file will not negatively impact expected business processes, run the enable-allowed-images-settings command (OSX/Linux/UNIX) to enable the Allowed AMIs feature in the selected AWS region:

aws ec2 enable-allowed-images-settings
	--region us-east-1
	--allowed-images-settings-state enabled

09 The command output should return the current state of the Allowed AMIs feature (i.e., "enabled"):

{
	"AllowedImagesSettingsState": "enabled"
}

10 Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other AWS regions.