AWS ec2 medium security documentation change
Summary
Restructured documentation to emphasize specialized AMI types, added NitroTPM/UEFI Secure Boot AMI section, expanded search examples, and added language-specific AMI information
Security assessment
Added documentation for NitroTPM-enabled AMIs which implement hardware-rooted trust and Secure Boot capabilities. STIG Hardened AMIs reference compliance with DoD security standards. These changes document security-enhancing features rather than patching vulnerabilities.
Diff
diff --git a/ec2/latest/windows-ami-reference/specialized-windows-amis.md b/ec2/latest/windows-ami-reference/specialized-windows-amis.md index 8cfd194e2..520593728 100644 --- a//ec2/latest/windows-ami-reference/specialized-windows-amis.md +++ b//ec2/latest/windows-ami-reference/specialized-windows-amis.md @@ -5 +5 @@ -# Specialized AWS Windows AMIs +Find an AWS Windows AMI @@ -7 +7 @@ -You can use specialized AWS Windows AMIs to create instances for your database and compliance hardening use cases as follows. +# Specialized AWS Windows AMIs @@ -9 +9 @@ You can use specialized AWS Windows AMIs to create instances for your database a -**SQL Server AMIs** +In addition to its standard operating system version AMIs, Amazon creates the following types of specialized AWS Windows AMIs: @@ -10,0 +11 @@ You can use specialized AWS Windows AMIs to create instances for your database a +**SQL Server license-included AMIs** @@ -12 +12,0 @@ You can use specialized AWS Windows AMIs to create instances for your database a -Some AWS Windows AMIs include an edition of Microsoft SQL Server (SQL Enterprise Edition, SQL Server Standard, SQL Server Express, or SQL Server Web). Launching an instance from a Windows AMI with Microsoft SQL Server enables you to run the instance as a database server. Alternatively, you can launch an instance from any Windows AMI and then install the database software that you need on the instance. @@ -14 +14 @@ Some AWS Windows AMIs include an edition of Microsoft SQL Server (SQL Enterprise -To discover available SQL Server license-included AMIs, see [Find a SQL Server license-included AMI](https://docs.aws.amazon.com/sql-server-ec2/latest/userguide/sql-server-on-ec2-amis.html) in the _Microsoft SQL Server on Amazon EC2 User Guide_. +Launching an instance from a Windows AMI with Microsoft SQL Server enables you to run the instance as a database server. For more information, see [AWS Windows Server license-included SQL Server AMIs](./ami-windows-sql.html). @@ -20,0 +21,95 @@ STIG Hardened EC2 Windows Server AMIs are pre-configured with over 160 required +**NitroTPM enabled AMIs** + + +Amazon creates a set of AMIs that are pre-configured with NitroTPM and UEFI Secure Boot requirements. For more information, see [AWS Windows Server NitroTPM enabled AMIs](./ami-windows-tpm.html). + +You can also create your own customized AMI from one of the AWS Windows AMIs with EC2 Image Builder. For more information, see the [EC2 Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/). + +We recommend PowerShell for the command line examples in this section. To install PowerShell in your environment, see the [Installation](https://docs.aws.amazon.com/powershell/v4/userguide/pstools-getting-set-up.html) page in the _AWS Tools for PowerShell (version 4) User Guide_. + +###### Note + +Not all AMIs are available in all Regions. + +## Find an AWS Windows AMI + +Each of the specialized AMI pages linked above has its own filtered search examples, as follows: + + * [Find Windows Server AMIs with Microsoft SQL Server](./ami-windows-sql.html#ami-windows-sql-find) + + * [Find a STIG Hardened AMI](./ami-windows-stig.html#find-windows-stig-ami) + + * [Find Windows Server AMIs configured with NitroTPM and UEFI Secure Boot](./ami-windows-tpm.html#ami-windows-tpm-find) + + + + +You can also search for the latest Windows AMIs that include the EC2Launch v2 agent, as shown in the following PowerShell example: + + + Get-SSMLatestEC2Image ` + -Path ami-windows-latest ` + -ImageName EC2LaunchV2-Windows* | ` + Sort-Object Name + + +###### Note + +If this command doesn't run in your environment, you might be missing a PowerShell module. For more information about this command, see [Get-SSMLatestEC2Image Cmdlet](https://docs.aws.amazon.com/powershell/v4/reference/items/Get-SSMLatestEC2Image.html). + +Alternatively, you can use the [CloudShell console](https://console.aws.amazon.com/cloudshell/home) and run `pwsh` to bring up a PowerShell prompt that already has all of the AWS tools installed. For more information, see the [AWS CloudShell User Guide](https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html). + +### Find an AWS Windows AMI in a specific language + +The following language-specific AWS Windows AMIs are included in the monthly release: + + * English + + * Japanese + + * Chinese + + * Korean + + * Czech + + * Dutch + + * French + + * German + + * Hungarian + + * Italian + + * Polish + + * Russian + + * Portuguese + + * Spanish + + * Swedish + + * Turkish + + + + +The following example uses PowerShell to search for the latest English language AWS Windows AMIs: + + + Get-SSMLatestEC2Image ` + -Path ami-windows-latest ` + -ImageName *Windows_Server-*English* | ` + Sort-Object Name + + +###### Note + +If this command doesn't run in your environment, you might be missing a PowerShell module. For more information about this command, see [Get-SSMLatestEC2Image Cmdlet](https://docs.aws.amazon.com/powershell/v4/reference/items/Get-SSMLatestEC2Image.html). + +Alternatively, you can use the [CloudShell console](https://console.aws.amazon.com/cloudshell/home) and run `pwsh` to bring up a PowerShell prompt that already has all of the AWS tools installed. For more information, see the [AWS CloudShell User Guide](https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html). + @@ -29 +124 @@ AWS Windows AMIs -STIG Hardened AMIs +SQL Server AMIs