AWS AWSEC2 documentation change
Summary
Added documentation about parameter syntax, versioning support, and CLI/PowerShell examples for using Systems Manager parameters to reference AMIs. Clarified parameter hierarchy and case sensitivity.
Security assessment
The changes emphasize parameter versioning and syntax precision, which helps prevent misconfigurations. While not addressing a specific vulnerability, version pinning improves security posture by ensuring AMI consistency.
Diff
diff --git a/AWSEC2/latest/UserGuide/using-systems-manager-parameter-to-find-AMI.md b/AWSEC2/latest/UserGuide/using-systems-manager-parameter-to-find-AMI.md index 35e066b09..4989705e1 100644 --- a//AWSEC2/latest/UserGuide/using-systems-manager-parameter-to-find-AMI.md +++ b//AWSEC2/latest/UserGuide/using-systems-manager-parameter-to-find-AMI.md @@ -62,0 +63,2 @@ AMIs and Systems Manager parameters are Region specific. To use the same Systems +Parameter names are case-sensitive. Backslashes for the parameter name are only necessary when the parameter is part of a hierarchy, for example, `/amis/production/golden-ami`. You can omit the backslash if the parameter is not part of a hierarchy. + @@ -65 +67,13 @@ AMIs and Systems Manager parameters are Region specific. To use the same Systems -You can launch an instance using the console or the AWS CLI. Instead of specifying an AMI ID, you can specify an AWS Systems Manager parameter that points to an AMI ID. +When you launch an instance, instead of specifying an AMI ID, you can specify a Systems Manager parameter that points to an AMI ID. + +To specify the parameter programmatically, use the following syntax, where `resolve:ssm` is the standard prefix and `parameter-name` is the unique parameter name. + + + resolve:ssm:parameter-name + +Systems Manager parameters have version support. Each iteration of a parameter is assigned a unique version number. You can reference the version of the parameter as follows, where `version` is the unique version number. By default, the latest version of the parameter is used when no version is specified. + + + resolve:ssm:parameter-name:version + +To launch an instance using a public parameter provided by AWS, see [Reference the latest AMIs using Systems Manager public parameters](./finding-an-ami-parameter-store.html). @@ -67 +81,4 @@ You can launch an instance using the console or the AWS CLI. Instead of specifyi -###### To find an AMI using a Systems Manager parameter (console) +Console + + +###### To find an AMI using a Systems Manager parameter @@ -90 +107 @@ For more information about launching an instance using the launch instance wizar -###### To launch an instance using an AWS Systems Manager parameter instead of an AMI ID (AWS CLI) +AWS CLI @@ -92 +108,0 @@ For more information about launching an instance using the launch instance wizar -The following example uses the Systems Manager parameter `golden-ami` to launch an `m5.xlarge` instance. The parameter points to an AMI ID. @@ -94 +110 @@ The following example uses the Systems Manager parameter `golden-ami` to launch -To specify the parameter in the command, use the following syntax: `resolve:ssm:/`parameter-name``, where `resolve:ssm` is the standard prefix and `parameter-name` is the unique parameter name. Note that the parameter name is case-sensitive. Backslashes for the parameter name are only necessary when the parameter is part of a hierarchy, for example, `/amis/production/golden-ami`. You can omit the backslash if the parameter is not part of a hierarchy. +###### To launch an instance using a Systems Manager parameter @@ -96 +112 @@ To specify the parameter in the command, use the following syntax: `resolve:ssm: -In this example, the `--count` and `--security-group` parameters are not included. For `--count`, the default is 1. If you have a default VPC and a default security group, they are used. +Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command with the `--image-id` option. This example uses a Systems Manager parameter named `golden-ami`, which specifies an AMI ID. @@ -99 +114,0 @@ In this example, the `--count` and `--security-group` parameters are not include - aws ec2 run-instances @@ -101,2 +115,0 @@ In this example, the `--count` and `--security-group` parameters are not include - --instance-type m5.xlarge - ... @@ -104 +117 @@ In this example, the `--count` and `--security-group` parameters are not include -###### To launch an instance using a specific version of an AWS Systems Manager parameter (AWS CLI) +You can create versions of a Systems Manager parameter. The following example specifies version 2 of the `golden-ami` parameter. @@ -106 +118,0 @@ In this example, the `--count` and `--security-group` parameters are not include -Systems Manager parameters have version support. Each iteration of a parameter is assigned a unique version number. You can reference the version of the parameter as follows `resolve:ssm:`parameter-name`:`version``, where `version` is the unique version number. By default, the latest version of the parameter is used when no version is specified. @@ -108 +120 @@ Systems Manager parameters have version support. Each iteration of a parameter i -The following example uses version 2 of the parameter. + --image-id resolve:ssm:/golden-ami:2 @@ -110 +122 @@ The following example uses version 2 of the parameter. -In this example, the `--count` and `--security-group` parameters are not included. For `--count`, the default is `1` If you have a default VPC and a default security group, they are used. +PowerShell @@ -113,4 +125,6 @@ In this example, the `--count` and `--security-group` parameters are not include - aws ec2 run-instances - --image-id resolve:ssm:/golden-ami:2 - --instance-type m5.xlarge - ... +###### To launch an instance using a Systems Manager parameter + +Use the [New-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Instance.html) cmdlet with the `-ImageId` parameter. This example uses a Systems Manager parameter named `golden-ami`, which specifies an AMI ID. + + + -ImageId "resolve:ssm:/golden-ami" @@ -118 +132 @@ In this example, the `--count` and `--security-group` parameters are not include -###### To launch an instance using a public parameter provided by AWS +You can create versions of a Systems Manager parameter. The following example specifies version 2 of the `golden-ami` parameter. @@ -120 +133,0 @@ In this example, the `--count` and `--security-group` parameters are not include -Systems Manager provides public parameters for public AMIs provided by AWS. You can use the public parameters when launching instances to ensure that you're using the latest AMIs. @@ -122 +135 @@ Systems Manager provides public parameters for public AMIs provided by AWS. You -For more information, see [Reference the latest AMIs using Systems Manager public parameters](./finding-an-ami-parameter-store.html). + -ImageId "resolve:ssm:/golden-ami:2"