AWS AWSEC2 documentation change
Summary
Updated AMI deprecation documentation with terminology changes ('Limitations' to 'Considerations'), added automation details for EBS-backed AMIs, clarified deprecation time limits, restructured content about describing deprecated AMIs, and added PowerShell examples
Security assessment
Changes focus on documentation clarity, terminology consistency, and added operational guidance. No evidence of addressing security vulnerabilities or describing new security features. The 2-year default deprecation for public AMIs is a lifecycle policy, not a security mitigation.
Diff
diff --git a/AWSEC2/latest/UserGuide/ami-deprecate.md b/AWSEC2/latest/UserGuide/ami-deprecate.md index 769e40973..19e4ae666 100644 --- a//AWSEC2/latest/UserGuide/ami-deprecate.md +++ b//AWSEC2/latest/UserGuide/ami-deprecate.md @@ -5 +5 @@ -CostsLimitationsDeprecate an AMIDescribe deprecated AMIsCancel AMI deprecation +CostsConsiderationsDeprecate an AMIDescribe deprecated AMIsCancel AMI deprecation @@ -28,6 +27,0 @@ You can deprecate both private and public AMIs. -You can also create Amazon Data Lifecycle Manager EBS-backed AMI policies to automate the deprecation of EBS-backed AMIs. For more information, see [Automate AMI lifecycles](https://docs.aws.amazon.com/ebs/latest/userguide/ami-policy.html). - -###### Note - -By default, the deprecation date of all public AMIs is set to two years from the AMI creation date. You can set the deprecation date to earlier than two years. To cancel the deprecation date, or to move the deprecation to a later date, you must make the AMI private by only [sharing it with specific AWS accounts](./sharingamis-explicit.html). - @@ -38 +32 @@ By default, the deprecation date of all public AMIs is set to two years from the - * Limitations + * Considerations @@ -53 +47 @@ When you deprecate an AMI, the AMI is not deleted. The AMI owner continues to pa -## Limitations +## Considerations @@ -56,0 +51,6 @@ When you deprecate an AMI, the AMI is not deleted. The AMI owner continues to pa + * AMIs that have not been used recently to launch an instance might be good candidates for deprecation or deregistering. For more information, see [Check when an Amazon EC2 AMI was last used](./ami-last-launched-time.html). + + * You can create Amazon Data Lifecycle Manager EBS-backed AMI policies to automate the deprecation of EBS-backed AMIs. For more information, see [Create AMI lifecycle policies](https://docs.aws.amazon.com/ebs/latest/userguide/ami-policy.html). + + * By default, the deprecation date of all public AMIs is set to two years from the AMI creation date. You can set the deprecation date to earlier than two years. To cancel the deprecation date, or to move the deprecation to a later date, you must make the AMI private by only [sharing it with specific AWS accounts](./sharingamis-explicit.html). + @@ -62 +62,3 @@ When you deprecate an AMI, the AMI is not deleted. The AMI owner continues to pa -You can deprecate an AMI on a specific date and time. You must be the AMI owner to perform this procedure. +You can deprecate an AMI on a specific date and time. You must be the owner of the AMI. + +The upper limit for the deprecation date is 10 years from now, except for public AMIs, where the upper limit is 2 years from the creation date. You can't specify a date in the past. @@ -79,2 +80,0 @@ Console -The upper limit for the deprecation date is 10 years from now, except for public AMIs, where the upper limit is 2 years from the creation date. You can’t specify a date in the past. - @@ -91,3 +91 @@ AWS CLI -Use the [enable-image-deprecation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/enable-image-deprecation.html) command. Specify the ID of the AMI and the date and time on which to deprecate the AMI. If you specify a value for seconds, Amazon EC2 rounds the seconds to the nearest minute. - -The upper limit for `deprecate-at` is 10 years from now, except for public AMIs, where the upper limit is 2 years from the creation date. You can’t specify a date in the past. +Use the following [enable-image-deprecation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/enable-image-deprecation.html) command. If you specify a value for seconds, Amazon EC2 rounds the seconds to the nearest minute. @@ -97,4 +95,2 @@ The upper limit for `deprecate-at` is 10 years from now, except for public AMIs, - --image-id ami-1234567890abcdef0 \ - --deprecate-at "2021-10-15T13:17:12.000Z" - -Expected output + --image-id ami-0abcdef1234567890 \ + --deprecate-at "2025-04-15T13:17:12.000Z" @@ -101,0 +98 @@ Expected output +PowerShell @@ -103,3 +99,0 @@ Expected output - { - "Return": "true" - } @@ -107,5 +101 @@ Expected output -### Check when an AMI was last used - -`LastLaunchedTime` is a timestamp that indicates when your AMI was last used to launch an instance. AMIs that have not been used recently to launch an instance might be good candidates for deprecation or [deregistering](./deregister-ami.html). - -###### Note +###### To deprecate an AMI on a specific date @@ -113 +103 @@ Expected output - * When an AMI is used to launch an instance, there is a 24-hour delay before that usage is reported. +Use the following [Enable-EC2ImageDeprecation](https://docs.aws.amazon.com/powershell/latest/reference/items/Enable-EC2ImageDeprecation.html) cmdlet. If you specify a value for seconds, Amazon EC2 rounds the seconds to the nearest minute. @@ -115 +104,0 @@ Expected output - * `lastLaunchedTime` data is available starting April 2017. @@ -116,0 +106,3 @@ Expected output + Enable-EC2ImageDeprecation ` + -ImageId ami-0abcdef1234567890 ` + -DeprecateAt 2025-04-15T13:17:12.000Z @@ -117,0 +110 @@ Expected output +## Describe deprecated AMIs @@ -118,0 +112 @@ Expected output +You can view the deprecation date and time of an AMI, and filter AMIs by deprecation date. @@ -123 +117 @@ Console -###### To view the last launched time of an AMI +###### To view the deprecation date of an AMI @@ -127,3 +121 @@ Console - 2. In the left navigator, choose **AMIs**. - - 3. From the filter bar, choose **Owned by me**. + 2. In the left navigator, choose **AMIs** , and then select the AMI. @@ -131 +123 @@ Console - 4. Select the AMI, and then check the **Last launched time** field (if you selected the checkbox next to the AMI, it's located on the **Details** tab). The field shows the date and time when the AMI was last used to launch an instance. + 3. Check the **Deprecation time** field (if you selected the checkbox next to the AMI, it's located on the **Details** tab). The field shows the deprecation date and time of the AMI. If the field is empty, the AMI is not deprecated. @@ -136 +128 @@ Console -AWS CLI +###### To filter AMIs by deprecation date @@ -137,0 +130 @@ AWS CLI + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -139 +132 @@ AWS CLI -###### To view the last launched time of an AMI + 2. In the left navigator, choose **AMIs**. @@ -141 +134 @@ AWS CLI -Run the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-image-attribute.html) command and specify `--attribute lastLaunchedTime`. You must be the AMI owner to run this command. + 3. From the filter bar, choose **Owned by me** or **Private images** (private images include AMIs that are shared with you as well as owned by you). @@ -142,0 +136 @@ Run the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation + 4. In the Search bar, enter `Deprecation time` (as you enter the letters, the **Deprecation time** filter appears), and then choose an operator and a date and time. @@ -144,3 +137,0 @@ Run the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation - aws ec2 describe-image-attribute \ - --image-id ami-1234567890example \ - --attribute lastLaunchedTime @@ -148 +138,0 @@ Run the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation -Example output @@ -151,6 +141 @@ Example output - { - "LastLaunchedTime": { - "Value": "2022-02-10T02:03:18Z" - }, - "ImageId": "ami-1234567890example", - } +AWS CLI @@ -158 +142,0 @@ Example output -## Describe deprecated AMIs @@ -160 +144 @@ Example output -You can view the deprecation date and time of an AMI, and filter all the AMIs by deprecation date. You can also use the AWS CLI to describe all the AMIs that have been deprecated, where the deprecation date is in the past. +When you describe all AMIs, the results depend on whether you are an AMI user or the AMI owner. @@ -162 +146 @@ You can view the deprecation date and time of an AMI, and filter all the AMIs by -Console + * AMI user – By default, when you describe all AMIs, deprecated AMIs that are shared with you but not owned by you are excluded. To include deprecated AMIs in the results, specify the `--include-deprecated` option. @@ -163,0 +148 @@ Console + * AMI owner – When you describe all AMIs, all AMIs that you own, including deprecated AMIs, are included. You can't exclude deprecated AMIs that you own by using the `--no-include-deprecated` option. @@ -165 +149,0 @@ Console -###### To view the deprecation date of an AMI @@ -167 +150,0 @@ Console - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -169 +151,0 @@ Console - 2. In the left navigator, choose **AMIs** , and then select the AMI. @@ -171 +153 @@ Console - 3. Check the **Deprecation time** field (if you selected the checkbox next to the AMI, it's located on the **Details** tab). The field shows the deprecation date and time of the AMI. If the field is empty, the AMI is not deprecated. +###### To include deprecated AMIs when describing all AMIs for an account @@ -172,0 +155 @@ Console +Use the following [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command. @@ -174,0 +158,3 @@ Console + aws ec2 describe-images + --owners 123456789012 \ + --include-deprecated @@ -176 +162 @@ Console -###### To filter AMIs by deprecation date +###### To describe the deprecated AMIs for your account @@ -178 +164 @@ Console - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). +Use the following [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command. @@ -180 +165,0 @@ Console - 2. In the left navigator, choose **AMIs**. @@ -182 +167,4 @@ Console - 3. From the filter bar, choose **Owned by me** or **Private images** (private images include AMIs that are shared with you as well as owned by you). + aws ec2 describe-images \ + --owners self \ + --query "Images[?DeprecationTime!=null].ImageId" \ + --output text @@ -184 +172 @@ Console - 4. In the Search bar, enter `Deprecation time` (as you enter the letters, the **Deprecation time** filter appears), and then choose an operator and a date and time. +The following is example output. @@ -186,0 +175 @@ Console + ami-0abcdef1234567890 @@ -187,0 +177 @@ Console +###### To describe the deprecation date of an AMI @@ -189 +179 @@ Console -AWS CLI +Use the following [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command. If `DeprecationTime` is not present in the output, the AMI is not deprecated or set to deprecate at a future date. @@ -192 +182,4 @@ AWS CLI -When you describe all AMIs using the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command, the results are different depending on whether you are an AMI user or the AMI owner. + aws ec2 describe-images \ + --image-ids ami-0abcdef1234567890 \ + --query Images[].DeprecationTime \ + --output text @@ -194 +187 @@ When you describe all AMIs using the [describe-images](https://awscli.amazonaws. - * If you are an AMI user: +The following is example output. @@ -196 +188,0 @@ When you describe all AMIs using the [describe-images](https://awscli.amazonaws. -By default, when you describe all AMIs using the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command, deprecated AMIs that are not owned by you, but which are shared with you, do not appear in the results. This is because the default is `--no-include-deprecated`. To include deprecated AMIs in the results, you must specify the `--include-deprecated` parameter. @@ -198 +190 @@ By default, when you describe all AMIs using the [describe-images](https://awscl - * If you are the AMI owner: + 2025-05-01T00:00:00.000Z @@ -200 +192 @@ By default, when you describe all AMIs using the [describe-images](https://awscl -When you describe all AMIs using the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command, all the AMIs that you own, including deprecated AMIs, appear in the results. You do not need to specify the `--include-deprecated` parameter. Furthermore, you cannot exclude deprecated AMIs that you own from the results by using `--no-include-deprecated`. +PowerShell @@ -202,0 +195 @@ When you describe all AMIs using the [describe-images](https://awscli.amazonaws. +###### To list the deprecated AMIs for your account @@ -203,0 +197 @@ When you describe all AMIs using the [describe-images](https://awscli.amazonaws. +Use the following [Get-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Image.html) cmdlet. @@ -205 +198,0 @@ When you describe all AMIs using the [describe-images](https://awscli.amazonaws. -If an AMI is deprecated, the `DeprecationTime` field appears in the results. @@ -207 +200 @@ If an AMI is deprecated, the `DeprecationTime` field appears in the results. -###### Note + (Get-EC2Image -Owner self | Where-Object {$_.DeprecationTime -ne $null}).ImageId @@ -209 +202 @@ If an AMI is deprecated, the `DeprecationTime` field appears in the results. -A deprecated AMI is an AMI whose deprecation date is in the past. If you have set the deprecation date to a date in the future, the AMI is not yet deprecated. +The following is example output. @@ -211 +203,0 @@ A deprecated AMI is an AMI whose deprecation date is in the past. If you have se -###### To include all deprecated AMIs when describing all AMIs @@ -213 +205 @@ A deprecated AMI is an AMI whose deprecation date is in the past. If you have se -Use the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command and specify the `--include-deprecated` parameter to include all deprecated AMIs that are not owned by you in the results. + ami-0abcdef1234567890 @@ -214,0 +207 @@ Use the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/late +###### To describe the deprecation date of an AMI @@ -216,4 +209 @@ Use the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/late - aws ec2 describe-images \ - --region us-east-1 \ - --owners 123456example