AWS imagebuilder documentation change
Summary
Updated AMI source configuration to support SSM Parameter Store parameters for AMI IDs and revised component parameter documentation
Security assessment
The change introduces support for SSM Parameter Store parameters to securely reference AMI IDs, reducing exposure of sensitive identifiers in plain text. While this improves security practices, there is no evidence of addressing a specific existing vulnerability.
Diff
diff --git a/imagebuilder/latest/userguide/create-container-recipes.md b/imagebuilder/latest/userguide/create-container-recipes.md index 401980f54..b01011f55 100644 --- a//imagebuilder/latest/userguide/create-container-recipes.md +++ b//imagebuilder/latest/userguide/create-container-recipes.md @@ -75 +75,5 @@ Docker Hub image - * **AMI ID** – Pre-filled, but editable. + * **AMI source** (Required) – Identify a custom AMI to use as the base image for your container build and test instance. This can be an AMI ID or an AWS Systems Manager (SSM) Parameter Store parameter that contains an AMI ID. + + * **AMI ID** – This setting is not pre-filled with your original entry. Enter the AMI ID for your base image. Example: ``ami-1234567890abcdef1``. + + * **SSM parameter** – Enter the name or ARN of the SSM Parameter Store parameter that contains the AMI ID for your base image. Example: ``/ib/test/param`` or `arn:aws:ssm:`us-east-1`:`111122223333`:parameter`/ib/test/param``. @@ -239 +243 @@ Component parameters are plain text values, and are logged in AWS CloudTrail. We - * image (string) – The AMI ID to use as the base image for a container build and test instance. If you don't specify this value, Image Builder uses the appropriate Amazon ECS optimized AMI as a base image. + * image (string) – The base image for a container build and test instance. This can contain an AMI ID or it can specify an AWS Systems Manager (SSM) Parameter Store parameter, prefixed by `ssm:`, followed by the parameter name or ARN. If you use an SSM parameter, the parameter value must contain an AMI ID. If you don't specify a base image, Image Builder uses the appropriate Amazon ECS optimized AMI as a base image. @@ -266 +270 @@ Component parameters are plain text values, and are logged in AWS CloudTrail. We - "componentArn": "arn:aws:imagebuilder:us-east-1:123456789012:component/helloworldal2/x.x.x" + "componentArn": "arn:aws:imagebuilder:us-west-2:111122223333:component/helloworldal2/x.x.x" @@ -280 +284 @@ Component parameters are plain text values, and are logged in AWS CloudTrail. We - "image": "ami-1234567890", + "image": "ami-1234567890abcdef1",