AWS AWSEC2 documentation change
Summary
Added documentation about optional snapshot deletion during AMI deregistration, clarifying behavior when snapshots are associated with multiple AMIs. Updated CLI/PowerShell examples and console instructions to include snapshot deletion options.
Security assessment
The changes focus on cost management and operational clarity by explaining snapshot retention rules. While this helps prevent unintended resource retention, there is no evidence of addressing a security vulnerability or weakness. The documentation update is about resource lifecycle management rather than security controls.
Diff
diff --git a/AWSEC2/latest/UserGuide/deregister-ami.md b/AWSEC2/latest/UserGuide/deregister-ami.md index 62de2e1d1..2364fbf58 100644 --- a//AWSEC2/latest/UserGuide/deregister-ami.md +++ b//AWSEC2/latest/UserGuide/deregister-ami.md @@ -13 +13,3 @@ To protect against accidental or malicious deregistering of an AMI, you can turn -Deregistering an AMI has no effect on any instances that were launched from the AMI. You can continue to use these instances. Deregistering an AMI also has no effect on any snapshots that were created during the AMI creation process. You'll continue to incur usage costs for these instances and storage costs for the snapshots. Therefore, to avoid incurring unnecessary costs, we recommend that you terminate any instances and delete any snapshots that you do not need. For more information, see Avoid costs from unused resources. +When deregistering an AMI, you can optionally delete its associated snapshots at the same time. However, if a snapshot is associated with multiple AMIs, it won't be deleted even if specified for deletion, although the AMI will still be deregistered. Any snapshots not deleted will continue to incur storage costs. + +Deregistering an AMI has no effect on any instances that were launched from the AMI. You can continue to use these instances. By default, deregistering an AMI also has no effect on any snapshots that were created during the AMI creation process. You'll continue to incur usage costs for these instances and storage costs for the snapshots. Therefore, to avoid incurring unnecessary costs, we recommend that you terminate any instances and delete any snapshots that you do not need. You can delete the snapshots either automatically during deregistration or manually after deregistration. For more information, see Avoid costs from unused resources. @@ -41 +43 @@ For instances launched from an AMI that is subsequently deregistered, you can st -You can deregister EBS-backed AMIs and instance store-backed AMIs. +You can deregister EBS-backed AMIs and instance store-backed AMIs. For EBS-backed AMIs, you can optionally delete the associated snapshots at the same time. However, if a snapshot is associated with other AMIs, it will not be deleted even if specified for deletion. @@ -58 +60,7 @@ Console - 6. When you are prompted for confirmation, choose **Deregister AMI**. + 6. (Optional) To delete the associated snapshots during deregistration, select the **Delete associated snapshots** checkbox. + +###### Note + +If a snapshot is associated with other AMIs, it is not deleted, even if the checkbox is selected. + + 7. Choose **Deregister AMI**. @@ -74,0 +83,9 @@ Use the following [deregister-image](https://awscli.amazonaws.com/v2/documentati +###### To deregister an AMI and delete its associated snapshots + +Use the following [deregister-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/deregister-image.html) command and specify the `--delete-associated-snapshots` parameter. Note that if a snapshot is associated with other AMIs, it is not deleted, even if you specify this parameter. + + + aws ec2 deregister-image \ + --image-id ami-0abcdef1234567890 \ + --delete-associated-snapshots + @@ -84,0 +102,9 @@ Use the [Unregister-EC2Image](https://docs.aws.amazon.com/powershell/latest/refe +###### To deregister an AMI and delete its associated snapshots + +Use the [Unregister-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Unregister-EC2Image.html) cmdlet and specify the `-DeleteAssociatedSnapshots` parameter. Note that if a snapshot is associated with other AMIs, it is not deleted, even if you specify this parameter. + + + Unregister-EC2Image ` + -ImageId ami-0abcdef1234567890 ` + -DeleteAssociatedSnapshots + @@ -87 +113 @@ Use the [Unregister-EC2Image](https://docs.aws.amazon.com/powershell/latest/refe -Deregistering an AMI doesn't delete all of the resources that are associated with the AMI. These resources include the snapshots for EBS-backed AMIs and the files in Amazon S3 for instance store-backed AMIs. When you deregister an AMI, you also don't terminate or stop any instances launched from the AMI. +Deregistering an AMI doesn't, by default, delete all of the resources that are associated with the AMI. These resources include the snapshots for EBS-backed AMIs and the files in Amazon S3 for instance store-backed AMIs. When you deregister an AMI, you also don't terminate or stop any instances launched from the AMI. @@ -95 +121,3 @@ To avoid incurring these types of unnecessary costs, we recommend deleting any r - * [Delete the snapshot](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-deleting-snapshot.html#ebs-delete-snapshot) of the instance root volume that was created during AMI creation. The description of the snapshot is structured as follows: + * Delete the associated snapshots while deregistering the AMI. For more information, see Deregister an AMI. + + * If you deregister an AMI without deleting its associated snaphots, you can manually [delete the snapshots](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-deleting-snapshot.html#ebs-delete-snapshot). The snapshot of the instance root volume created during AMI creation has the following description format: