AWS AWSEC2 documentation change
Summary
Updated AMI copying documentation with expanded explanations of cross-region, cross-partition, and cross-account copying methods. Added details about time-based copy operations, tag handling, and revised pricing/clarified encryption requirements.
Security assessment
The changes clarify security-related aspects like encryption requirements for EBS-backed AMIs and tag propagation limitations (system tags and cross-account tags aren't copied), but there's no evidence of addressing a specific security vulnerability. The encryption and tag handling explanations enhance security documentation.
Diff
diff --git a/AWSEC2/latest/UserGuide/CopyingAMIs.md b/AWSEC2/latest/UserGuide/CopyingAMIs.md index 23279f6ae..e28aba2c1 100644 --- a//AWSEC2/latest/UserGuide/CopyingAMIs.md +++ b//AWSEC2/latest/UserGuide/CopyingAMIs.md @@ -9 +9 @@ ConsiderationsCostsCopy an AMIStop a pending AMI copy operation -You can create a copy of an Amazon Machine Image (AMI) within the same Region or across Regions in the same partition. If you need your AMI copies to complete within a specific timeframe, you can optionally initiate time-based AMI copy operations. With time-based AMI copy operations, you specificy a completion duration, between 15 minutes and 48 hours, in which the copy operation is to be completed. For more information, see [Time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html) in the _Amazon EBS User Guide_. +When you need a consistent Amazon EC2 instance configuration across multiple Regions, you can use a single Amazon Machine Image (AMI) as your template to launch all the instances. However, AMIs are Region-specific resources—to launch an instance in a specific AWS Region, the AMI must be located in that Region. Therefore, to use the same AMI in multiple Regions, you must copy it from the source Region to each target Region. @@ -11 +11,12 @@ You can create a copy of an Amazon Machine Image (AMI) within the same Region or -To copy an AMI to another partition, see [Store and restore an AMI](./ami-store-restore.html). +The method you use to copy an AMI depends on whether you're copying across Regions _within the same[partition](https://docs.aws.amazon.com/glossary/latest/reference/glos-chap.html#partition)_ or _across different partitions_ : + + * **Cross-Region copying** – Copy AMIs across Regions _within the same partition_ , for example, across the Regions within the commercial partition. This copy method is described in this topic. + + * **Cross-partition copying** – Copy AMIs _from one partition to another partition_ , for example, from the commercial partition to the AWS GovCloud (US) partition. For information about this copy method, see [Store and restore an AMI](./ami-store-restore.html). + + * **Cross-account copying** – Create a copy of an AMI that another AWS account has [shared with your AWS account](./sharingamis-explicit.html). This copy method is described in this topic. + + + + +The time taken to complete the copy operation for cross-Region and cross-account AMI copying is on a best-effort basis. If you need control over the completion time, you can specify a completion window ranging from 15 minutes to 48 hours, ensuring your AMI is copied within your required timeframe. Additional charges apply for time-based AMI copy operations. For more information, see [Time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html) in the _Amazon EBS User Guide_. @@ -38 +49 @@ To copy an AMI to another partition, see [Store and restore an AMI](./ami-store- - * **Quotas for time-based AMI copies** – Once you reach your _cumulative snapshot copy throughput quota_ , subsequent time-based AMI copy requests fail. For more information, see [ Quotas for time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html#time-based-copies-quota) in the _Amazon EBS User Guide_. + * **Quotas for time-based AMI copies** – After you reach your _cumulative snapshot copy throughput quota_ , subsequent time-based AMI copy requests fail. For more information, see [Quotas for time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html#time-based-copies-quota) in the _Amazon EBS User Guide_. @@ -45 +56 @@ To copy an AMI to another partition, see [Store and restore an AMI](./ami-store- -There are no charges for copying an AMI. However, standard storage and data transfer rates apply. If you copy an EBS-backed AMI, you will incur charges for the storage of any additional EBS snapshots. +There is no charge for copying an AMI when no completion time is specified. However, additional charges apply for time-based AMI copy operations. For more information, see [Time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html#time-based-copies-pricing) in the _Amazon EBS User Guide_. @@ -47 +58 @@ There are no charges for copying an AMI. However, standard storage and data tran -Additional charges apply for time-based AMI copy operations. For more information, see [ Time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html#time-based-copies-pricing) in the _Amazon EBS User Guide_. +Standard storage and data transfer rates apply. If you copy an EBS-backed AMI, you will incur charges for the storage of any additional EBS snapshots. @@ -51 +62 @@ Additional charges apply for time-based AMI copy operations. For more informatio -You can copy an AMI using the following procedures. +You can copy an AMI to the same Region or another Region within the same partition. You can copy an AMI that you own or an AMI that was shared with you from another account. @@ -68 +79 @@ Console - 6. On the **Copy AMI** page, specify the following information: + 6. On the **Copy Amazon Machine Image (AMI)** page, specify the following information: @@ -74 +85,5 @@ Console - 3. **Destination Region** : The Region in which to copy the AMI. For more information, see [Cross-Region copying](./how-ami-copy-works.html#copy-amis-across-regions). + 3. **Destination Region** : The Region in which to copy the AMI. For more information, see [Cross-Region copying](./how-ami-copy-works.html#copy-amis-across-regions) and [Cross-account copying](./how-ami-copy-works.html#copy-ami-across-accounts). + + 4. **Copy tags** : Select this checkbox to include your user-defined AMI tags when copying the AMI. System tags (prefixed with `aws:`) and user-defined tags that are attached by other AWS accounts will not be copied. + + 5. **Time-based copy** : You can specify whether the copy operation completes within a specific timeframe or on a best-effort basis, as follows: @@ -76 +91 @@ Console - 4. If you need the copy to be completed within a specific timeframe, select **Enable time-based copy**. For **Completion duration** , enter the required completion duration, in 15-minute increments. The completion duration applies to all snapshots associated with the AMI. For more information, see [ Time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html) in the _Amazon EBS User Guide_. + * To complete the copy within a specific timeframe: @@ -78 +93 @@ Console -If you do not need the AMI copy to be completed in a specific timeframe, do not enable time-based copy. In this case, the snapshot copy is completed on a best-effort basis. + * Select **Enable time-based copy**. @@ -80 +95,7 @@ If you do not need the AMI copy to be completed in a specific timeframe, do not - 5. **Copy tags** : Select this checkbox to include your user-defined AMI tags when copying the AMI. System tags (prefixed with `aws:`) and user-defined tags that are attached by other AWS accounts will not be copied. + * For **Completion duration** , enter the number of minutes (in 15-minute increments) allowed for the copy operation. The completion duration applies to all snapshots associated with the AMI. + +For more information, see [Time-based copies](https://docs.aws.amazon.com/ebs/latest/userguide/time-based-copies.html) in the _Amazon EBS User Guide_. + + * To complete the copy on a best-effort basis: + + * Leave **Enable time-based copy** unselected. @@ -104 +125,3 @@ AWS CLI -###### To copy an AMI using the AWS CLI +###### To copy an AMI + +Use the [copy-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-image.html) command. You must specify both the source and destination Regions. You specify the source Region using the `--source-region` parameter. You can specify the destination Region using the `--region` parameter, if you haven't already configured a Region for the AWS CLI. @@ -106 +128,0 @@ AWS CLI -You can copy an AMI using the [copy-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-image.html) command. You must specify both the source and destination Regions. You specify the source Region using the `--source-region` parameter. You can specify the destination Region using either the `--region` parameter or an environment variable. For more information, see [Configuring the AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html). @@ -108 +130,5 @@ You can copy an AMI using the [copy-image](https://awscli.amazonaws.com/v2/docum -(EBS-backed AMIs only) When you encrypt a target snapshot during copying, you must specify these additional parameters: `--encrypted` and `--kms-key-id`. + aws ec2 copy-image \ + --source-image-id ami-0abcdef1234567890 \ + --source-region us-west-2 \ + --name my-ami \ + --region us-east-1 @@ -110 +136 @@ You can copy an AMI using the [copy-image](https://awscli.amazonaws.com/v2/docum -For example commands, see the [Examples](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-image.html#examples) under [copy-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-image.html) in the _AWS CLI Command Reference_. +When you encrypt a target snapshot during AMI copy, you must specify these additional parameters: `--encrypted` and `--kms-key-id`. @@ -115 +141,4 @@ PowerShell -###### To copy an AMI using the Tools for Windows PowerShell +###### To copy an AMI + +Use the [Copy-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Copy-EC2Image.html) cmdlet. You must specify both the source and destination Regions. You specify the source Region using the `-SourceRegion` parameter. You can specify the destination Region using the `-Region` parameter or the [Set-AWSDefaultRegion](https://docs.aws.amazon.com/powershell/latest/userguide/pstools-installing-specifying-region.html) cmdlet. + @@ -117 +146,5 @@ PowerShell -You can copy an AMI using the [Copy-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Copy-EC2Image.html) command. You must specify both the source and destination Regions. You specify the source Region using the `-SourceRegion` parameter. You can specify the destination Region using either the `-Region` parameter or the `Set-AWSDefaultRegion` command. For more information, see [Specifying AWS Regions](https://docs.aws.amazon.com/powershell/latest/userguide/pstools-installing-specifying-region.html). + Copy-EC2Image ` + -SourceImageId ami-0abcdef1234567890 ` + -SourceRegion us-west-2 ` + -Name my-ami ` + -Region us-east-1 @@ -119 +152 @@ You can copy an AMI using the [Copy-EC2Image](https://docs.aws.amazon.com/powers -(EBS-backed AMIs only) When you encrypt a target snapshot during copying, you must specify these additional parameters: `-Encrypted` and `-KmsKeyId`. +When you encrypt a target snapshot during AMI copy, you must specify these additional parameters: `-Encrypted` and `-KmsKeyId`.