AWS managedservices documentation change
Summary
Updated AMI sharing process to support Organizational Units, added new parameters (OrganizationalUnitARNs, ShareSnapshots), updated CLI commands, and added security notes about encrypted AMI sharing requirements
Security assessment
Added documentation about security controls for encrypted AMI sharing requiring admin involvement, but no evidence of addressing a specific vulnerability
Diff
diff --git a/managedservices/latest/ctref/management-advanced-ami-share.md b/managedservices/latest/ctref/management-advanced-ami-share.md index 267b6adf9..573568d03 100644 --- a/managedservices/latest/ctref/management-advanced-ami-share.md +++ b/managedservices/latest/ctref/management-advanced-ami-share.md @@ -9 +9 @@ Change Type DetailsAdditional InformationExecution Input ParametersExample: Requ -Use to share an AMI with another AMS account. +Share an AMI with multiple AMS accounts or Organizational Units (OUs). @@ -17 +17 @@ Change type ID | ct-1eiczxw8ihc18 -Current version | 1.0 +Current version | 2.0 @@ -79 +79 @@ Issue the create RFC command with execution parameters provided inline (escape q - aws --profile saml amscm create-rfc --change-type-id "ct-1eiczxw8ihc18" --change-type-version "1.0" --title "AMI-Share-QC" --execution-parameters "{\"Description\":\"Share custom AMI\", \"AmiId\":\"AMI-ID\", \"TargetAwsAccountId\":, \"AWS-ACCOUNT-ID\":}" + aws amscm create-rfc --change-type-id "ct-1eiczxw8ihc18" --change-type-version "2.0" --title "Share AMI" --execution-parameters "{ \"DocumentName\": \"AWSManagedServices-ShareAMI\", \"Region\": \"us-east-1\", \"Parameters\": { \"ImageId\": \"amiid\" , \"OrganizationalUnitARNs\": \"ouarn\" } }" @@ -87 +87,13 @@ _TEMPLATE CREATE_ : - 2. Modify and save the execution parameters JSON file. For example, you can replace the contents with something like this: + 2. Modify and save the execution parameters JSON file. The JSON for only the required parameters and for all the parameters are shown. For example, you can replace the contents with something like this: + +Only required parameters: + + { + "DocumentName": "AWSManagedServices-ShareAMI", + "Region": "us-east-1", + "Parameters": { + "ImageId": "amiid" + } + } + +All parameters: @@ -90,2 +102,8 @@ _TEMPLATE CREATE_ : - "TargetAwsAccountId": "AMS_ACCOUNT_ID", - "AmiId": "AMI_ID" + "DocumentName": "AWSManagedServices-ShareAMI", + "Region": "us-east-1", + "Parameters": { + "AccountIds": "awsaccountid", + "ImageId": "amiid", + "OrganizationalUnitARNs": "ouarn", + "ShareSnapshots": "false" + } @@ -94 +112 @@ _TEMPLATE CREATE_ : - 3. Output the RFC template JSON file; this example names it EncryptAmiRfc.json: + 3. Output the RFC template JSON file; this example names it ShareAmiRfc.json: @@ -96 +114 @@ _TEMPLATE CREATE_ : - aws amscm create-rfc --generate-cli-skeleton > EncryptAmiRfc.json + aws amscm create-rfc --generate-cli-skeleton > ShareAmiRfc.json @@ -98 +116 @@ _TEMPLATE CREATE_ : - 4. Modify and save the EncryptAmiRfc.json file. For example, you can replace the contents with something like this: + 4. Modify and save the ShareAmiRfc.json file. For example, you can replace the contents with something like this: @@ -100,0 +119 @@ _TEMPLATE CREATE_ : + "ChangeTypeVersion": "2.0", @@ -102,2 +121 @@ _TEMPLATE CREATE_ : - "ChangeTypeVersion": "1.0", - "Title": "AMI-Share-RFC" + "Title": "Share" @@ -115 +133,6 @@ You receive the ID of the new RFC in the response and can use it to submit and m -###### Note + * An AMS AMI can't be shared to a non-AMS account. This change type copies an AMI from the source AWS Region to the same Region in the destination account. You must be onboarded to AMS in the destination AWS Region of the specified TargetAwsAccountId, or the shared AMI is unusable in the target account. + + * Additionally, encrypted AMIs can't be shared between accounts without the involvement of the AD administrator and an AMS Operations Engineer. If you want to do this, file a Management | Other | Other | Create (ct-1e1xtak34nx76) with AMS with the AMI ID, account information, and full details. + + * This change type is now at version 2.0. + @@ -117 +139,0 @@ You receive the ID of the new RFC in the response and can use it to submit and m -An AMS AMI can't be shared to a non-AMS account. This change type copies an AMI from the source AWS Region to the same Region in the destination account. You must be onboarded to AMS in the destination AWS Region of the specified TargetAwsAccountId, or the shared AMI is unusable in the target account. @@ -119 +140,0 @@ An AMS AMI can't be shared to a non-AMS account. This change type copies an AMI -Additionally, encrypted AMIs can't be shared between accounts without the involvement of the AD administrator and an AMS Operations Engineer. If you want to do this, file a Management | Other | Other | Create (ct-1e1xtak34nx76) with AMS with the AMI ID, account information, and full details. @@ -125 +146 @@ When sharing a custom AMI that you created from an instance in your AMS account, -To learn more about sharing AMIs, see [Sharing an AMI with Specific AWS Accounts](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html). +To learn more about sharing AMIs, see [Sharing an AMI with specific AWS accounts](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html). @@ -134 +155,7 @@ For detailed information about the execution input parameters, see [Schema for C - Example not available. + { + "DocumentName": "AWSManagedServices-ShareAMI", + "Region": "us-east-1", + "Parameters": { + "ImageId": "ami-12345678" + } + } @@ -140,2 +167,8 @@ For detailed information about the execution input parameters, see [Schema for C - "AmiId": "ami-12345678", - "TargetAwsAccountId": "123456789012" + "DocumentName": "AWSManagedServices-ShareAMI", + "Region": "us-east-1", + "Parameters": { + "ImageId": "ami-12345678", + "AccountIds": "123456789012", + "OrganizationalUnitARNs": "arn:aws:organizations::111111111111:organization/o-rkw1234jc5", + "ShareSnapshots": true + }