AWS AWSEC2 documentation change
Summary
Clarified KMS key requirement for encrypted snapshots in shared AMIs
Security assessment
Minor wording change from 'Amazon EBS snapshots' to 'EBS snapshots' in existing security guidance about KMS keys. No new security information added, just terminology normalization.
Diff
diff --git a/AWSEC2/latest/UserGuide/share-amis-org-ou-manage.md b/AWSEC2/latest/UserGuide/share-amis-org-ou-manage.md index 1306981c4..b4f1cce84 100644 --- a//AWSEC2/latest/UserGuide/share-amis-org-ou-manage.md +++ b//AWSEC2/latest/UserGuide/share-amis-org-ou-manage.md @@ -13 +13 @@ You can manage AMI sharing with organizations and organization units (OU) to con -You can use the Amazon EC2 console or the AWS CLI to check with which organizations and OUs you've shared your AMI. +You can find the organizations and OUs with which you've shared your AMI. @@ -34,2 +33,0 @@ AWS CLI -You can check which organizations and OUs you've shared your AMI with by using the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-image-attribute.html) command (AWS CLI) and the `launchPermission` attribute. - @@ -38 +36 @@ You can check which organizations and OUs you've shared your AMI with by using t -The [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-image-attribute.html) command describes the `launchPermission` attribute for the specified AMI, and returns the organizations and OUs with which you've shared the AMI. +Use the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-image-attribute.html) command with the `launchPermission` attribute. @@ -56,0 +55,12 @@ The following is an example response. +PowerShell + + +###### To check with which organizations and OUs you've shared your AMI + +Use the [Get-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2ImageAttribute.html) cmdlet. + + + Get-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission + @@ -59 +69 @@ The following is an example response. -You can use the Amazon EC2 console or the AWS CLI to share an AMI with an organization or OU. +You can share an AMI with an organization or OU. @@ -63 +73 @@ You can use the Amazon EC2 console or the AWS CLI to share an AMI with an organi -You do not need to share the Amazon EBS snapshots that an AMI references in order to share the AMI. Only the AMI itself needs to be shared, and the system automatically provides the instance with access to the referenced Amazon EBS snapshots for the launch. However, you do need to share the KMS keys used to encrypt snapshots that the AMI references. For more information, see [Allow organizations and OUs to use a KMS key](./allow-org-ou-to-use-key.html). +You do not need to share the Amazon EBS snapshots that an AMI references in order to share the AMI. Only the AMI itself needs to be shared, and the system automatically provides the instance with access to the referenced EBS snapshots for the launch. However, you do need to share the KMS keys used to encrypt snapshots that the AMI references. For more information, see [Allow organizations and OUs to use a KMS key](./allow-org-ou-to-use-key.html). @@ -94,2 +103,0 @@ AWS CLI -Use the [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-image-attribute.html) command to share an AMI. - @@ -98 +106 @@ Use the [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/a -The [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-image-attribute.html) command grants launch permissions for the specified AMI to the specified organization. Note that you must specify the full ARN, not just the ID. +Use the [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-image-attribute.html) command to grant launch permissions for the specified AMI to the specified organization. @@ -124 +132,5 @@ The following command grants launch permissions for the specified AMI to the spe - Edit-EC2ImageAttribute -ImageId ami-0abcdef1234567890 -Attribute launchPermission -OperationType add -OrganizationArn "arn:aws:organizations::123456789012:organization/o-123example" + Edit-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission ` + -OperationType add ` + -OrganizationArn "arn:aws:organizations::123456789012:organization/o-123example" @@ -131 +143,5 @@ The following command removes launch permissions for the specified AMI from the - Edit-EC2ImageAttribute -ImageId ami-0abcdef1234567890 -Attribute launchPermission -OperationType remove -OrganizationArn "arn:aws:organizations::123456789012:organization/o-123example" + Edit-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission ` + -OperationType remove ` + -OrganizationArn "arn:aws:organizations::123456789012:organization/o-123example" @@ -133 +149 @@ The following command removes launch permissions for the specified AMI from the -To stop sharing an AMI with all organizations, OUs, and AWS accounts +###### To stop sharing an AMI with all organizations, OUs, and AWS accounts @@ -138 +154,3 @@ The following command removes all public and explicit launch permissions from th - Reset-EC2ImageAttribute -ImageId ami-0abcdef1234567890 -Attribute launchPermission + Reset-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission @@ -142 +160 @@ The following command removes all public and explicit launch permissions from th -You can use the Amazon EC2 console or the AWS CLI to stop sharing an AMI with an organization or OU. +You can stop sharing an AMI with an organization or OU. @@ -171,2 +188,0 @@ AWS CLI -Use the [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-image-attribute.html) or [reset-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/reset-image-attribute.html) commands to stop sharing an AMI. - @@ -175 +191 @@ Use the [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/a -The [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-image-attribute.html) command removes launch permissions for the specified AMI from the specified organization. Note that you must specify the ARN. +Use the [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-image-attribute.html) command. This example removes launch permissions for the specified AMI from the specified organization. @@ -184 +200 @@ The [modify-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/l -The [reset-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/reset-image-attribute.html) command removes all public and explicit launch permissions from the specified AMI. Note that the owner of the AMI always has launch permissions and is therefore unaffected by this command. +Use the [reset-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/reset-image-attribute.html) command. This example removes all public and explicit launch permissions from the specified AMI. Note that the owner of the AMI always has launch permissions and is therefore unaffected by this command. @@ -190,0 +207,23 @@ The [reset-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/la +PowerShell + + +###### To stop sharing an AMI with an organization or OU + +Use the [Edit-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2ImageAttribute.html) cmdlet. This example removes launch permissions for the specified AMI from the specified organization. + + + Edit-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute launchPermission ` + -OperationType remove ` + -OrganizationArn "arn:aws:organizations::123456789012:organization/o-123example" + +###### To stop sharing an AMI with all organizations, OUs, and AWS accounts + +Use the [Reset-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Reset-EC2ImageAttribute.html) cmdlet. This example removes all public and explicit launch permissions from the specified AMI. Note that the owner of the AMI always has launch permissions and is therefore unaffected by this command. + + + Reset-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute LaunchPermission +