AWS AWSEC2 medium security documentation change
Summary
Updated documentation about sharing AMIs with specific accounts. Changes include: clarifying KMS key sharing requirements for encrypted snapshots, restructuring console/CLI/PowerShell sections, replacing placeholder account IDs with examples, and removing redundant notes about snapshot sharing.
Security assessment
Added explicit requirement to share KMS keys used for encrypted snapshots, which is a security control for data access. This addresses potential misconfiguration where users might share AMIs without proper encryption key permissions.
Diff
diff --git a/AWSEC2/latest/UserGuide/sharingamis-explicit.md b/AWSEC2/latest/UserGuide/sharingamis-explicit.md index a73cf2047..ac9179b87 100644 --- a//AWSEC2/latest/UserGuide/sharingamis-explicit.md +++ b//AWSEC2/latest/UserGuide/sharingamis-explicit.md @@ -11 +11 @@ You can share an AMI with specific AWS accounts without making the AMI public. A -An AWS account ID is a 12-digit number, such as `012345678901`, that uniquely identifies an AWS account. For more information, see [Viewing AWS account identifiers](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html) in the _AWS Account Management Reference Guide_. +An AWS account ID is a 12-digit number, such as `012345678901`, that uniquely identifies an AWS account. For more information, see [View AWS account identifiers](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html) in the _AWS Account Management Reference Guide_. @@ -22,0 +23,2 @@ Consider the following when sharing AMIs with specific AWS accounts. + * **Snapshots** – You do not need to share the Amazon EBS snapshots that an AMI references in order to share the AMI. You can share only the AMI itself; the system provides the instance access to the referenced EBS snapshots for the launch. However, you must share any KMS keys used to encrypt snapshots that an AMI references. For more information, see [Share an Amazon EBS snapshot](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html) in the _Amazon EBS User Guide_. + @@ -39,0 +42,3 @@ Consider the following when sharing AMIs with specific AWS accounts. +Console + + @@ -56,4 +60,0 @@ To share this AMI with multiple accounts, repeat Steps 5 and 6 until you have ad -###### Note - -You do not need to share the Amazon EBS snapshots that an AMI references in order to share the AMI. Only the AMI itself needs to be shared; the system automatically provides the instance access to the referenced Amazon EBS snapshots for the launch. However, you do need to share any KMS keys used to encrypt snapshots that the AMI references. For more information, see [Share an Amazon EBS snapshot](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html) in the _Amazon EBS User Guide_. - @@ -66,0 +68,3 @@ You do not need to share the Amazon EBS snapshots that an AMI references in orde +AWS CLI + + @@ -71 +75 @@ Use the [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/a -The following command grants launch permissions for the specified AMI to the specified AWS account. In the following example, replace the example AMI ID with a valid AMI ID, and replace ``account-id`` with the 12-digit AWS account ID. +The following command grants launch permissions for the specified AMI to the specified AWS account. @@ -76,5 +80 @@ The following command grants launch permissions for the specified AMI to the spe - --launch-permission "Add=[{UserId=account-id}]" - -###### Note - -You do not need to share the Amazon EBS snapshots that an AMI references in order to share the AMI. Only the AMI itself needs to be shared; the system automatically provides the instance access to the referenced Amazon EBS snapshots for the launch. However, you do need to share any KMS keys used to encrypt snapshots that the AMI references. For more information, see [Share an Amazon EBS snapshot](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html) in the _Amazon EBS User Guide_. + --launch-permission "Add=[{UserId=123456789012}]" @@ -84 +84 @@ You do not need to share the Amazon EBS snapshots that an AMI references in orde -The following command removes launch permissions for the specified AMI from the specified AWS account. In the following example, replace the example AMI ID with a valid AMI ID, and replace ``account-id`` with the 12-digit AWS account ID. +The following command removes launch permissions for the specified AMI from the specified AWS account. @@ -89 +89 @@ The following command removes launch permissions for the specified AMI from the - --launch-permission "Remove=[{UserId=account-id}]" + --launch-permission "Remove=[{UserId=123456789012}]" @@ -93 +93 @@ The following command removes launch permissions for the specified AMI from the -The following command removes all public and explicit launch permissions from the specified AMI. Note that the owner of the AMI always has launch permissions and is therefore unaffected by this command. In the following example, replace the example AMI ID with a valid AMI ID. +The following command removes all public and explicit launch permissions from the specified AMI. Note that the owner of the AMI always has launch permissions and is therefore unaffected by this command. @@ -100 +100 @@ The following command removes all public and explicit launch permissions from th -Use the [Edit-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2ImageAttribute.html) command (Tools for Windows PowerShell) to share an AMI as shown in the following examples. +PowerShell @@ -102 +101,0 @@ Use the [Edit-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/r -###### To grant explicit launch permissions @@ -104 +103 @@ Use the [Edit-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/r -The following command grants launch permissions for the specified AMI to the specified AWS account. In the following example, replace the example AMI ID with a valid AMI ID, and replace ``account-id`` with the 12-digit AWS account ID. +Use the [Edit-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2ImageAttribute.html) command (Tools for Windows PowerShell) to share an AMI as shown in the following examples. @@ -105,0 +105 @@ The following command grants launch permissions for the specified AMI to the spe +###### To grant explicit launch permissions @@ -107 +107 @@ The following command grants launch permissions for the specified AMI to the spe - PS C:\> Edit-EC2ImageAttribute -ImageId ami-0abcdef1234567890 -Attribute launchPermission -OperationType add -UserId "account-id" +The following command grants launch permissions for the specified AMI to the specified AWS account. @@ -109 +108,0 @@ The following command grants launch permissions for the specified AMI to the spe -###### Note @@ -111 +110,5 @@ The following command grants launch permissions for the specified AMI to the spe -You do not need to share the Amazon EBS snapshots that an AMI references in order to share the AMI. Only the AMI itself needs to be shared; the system automatically provides the instance access to the referenced Amazon EBS snapshots for the launch. However, you do need to share any KMS keys used to encrypt snapshots that the AMI references. For more information, see [Share an Amazon EBS snapshot](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html) in the _Amazon EBS User Guide_. + Edit-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission ` + -OperationType add ` + -UserId "123456789012" @@ -115 +118 @@ You do not need to share the Amazon EBS snapshots that an AMI references in orde -The following command removes launch permissions for the specified AMI from the specified AWS account. In the following example, replace the example AMI ID with a valid AMI ID, and replace ``account-id`` with the 12-digit AWS account ID. +The following command removes launch permissions for the specified AMI from the specified AWS account. @@ -118 +121,4 @@ The following command removes launch permissions for the specified AMI from the - PS C:\> Edit-EC2ImageAttribute -ImageId ami-0abcdef1234567890 -Attribute launchPermission -OperationType remove -UserId "account-id" + Edit-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission -OperationType remove ` + -UserId "123456789012" @@ -122 +128 @@ The following command removes launch permissions for the specified AMI from the -The following command removes all public and explicit launch permissions from the specified AMI. Note that the owner of the AMI always has launch permissions and is therefore unaffected by this command. In the following example, replace the example AMI ID with a valid AMI ID. +The following command removes all public and explicit launch permissions from the specified AMI. Note that the owner of the AMI always has launch permissions and is therefore unaffected by this command. @@ -125 +131,3 @@ The following command removes all public and explicit launch permissions from th - PS C:\> Reset-EC2ImageAttribute -ImageId ami-0abcdef1234567890 -Attribute launchPermission + Reset-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission