AWS imagebuilder documentation change
Summary
Restructured prerequisites section, added EC2 Fast Launch prerequisites with IAM policy requirements, updated examples to include launch template guidance, and added cross-account distribution limitation note
Security assessment
Added documentation about required EC2FastLaunchFullAccess IAM policy for secure Fast Launch configuration and explicit note about cross-account distribution limitations. While security-related configurations are documented, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/imagebuilder/latest/userguide/cr-upd-ami-distribution-settings.md b/imagebuilder/latest/userguide/cr-upd-ami-distribution-settings.md index 17d4ca13d..ede3d8c12 100644 --- a//imagebuilder/latest/userguide/cr-upd-ami-distribution-settings.md +++ b//imagebuilder/latest/userguide/cr-upd-ami-distribution-settings.md @@ -5 +5 @@ -Prerequisites for SSM output parametersCreate an AMI distribution configurationUpdate an AMI distribution configurationCreate distribution settings to enable EC2 Fast Launch for output AMIsCreate distribution settings for output VM disks from the AWS CLI +AMI distribution prerequisitesCreate an AMI distribution configurationUpdate an AMI distribution configurationExample: Enable EC2 Fast Launch with a launch template for output AMIsExample: Create distribution settings for output VM disks from the AWS CLI @@ -13 +13 @@ This section covers creating and updating distribution configurations for an Ima - * Prerequisites for SSM output parameters + * AMI distribution prerequisites @@ -19 +19 @@ This section covers creating and updating distribution configurations for an Ima - * Create distribution settings to enable EC2 Fast Launch for output AMIs + * Example: Enable EC2 Fast Launch with a launch template for output AMIs @@ -21 +21 @@ This section covers creating and updating distribution configurations for an Ima - * Create distribution settings for output VM disks from the AWS CLI + * Example: Create distribution settings for output VM disks from the AWS CLI @@ -26 +26,14 @@ This section covers creating and updating distribution configurations for an Ima -## Prerequisites for SSM output parameters +## AMI distribution prerequisites + +Some distribution settings have prerequisites, as follows: + +###### Topics + + * SSM output parameter prerequisites + + * EC2 Fast Launch prerequisites + + + + +### Prerequisites for SSM output parameters @@ -41,0 +55,25 @@ When you create a pipeline or use the create-image command in the AWS CLI, you c +### Prerequisites for EC2 Fast Launch + +Before you create a new distribution configuration for EC2 Fast Launch for Windows AMIs, ensure that you've met the following prerequisites. + + * If you provide a custom launch template when you configure EC2 Fast Launch, the service uses the VPC and other configuration settings that you've defined in the launch template. For more information, see [Use a launch template when you set up EC2 Fast Launch](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/win-fast-launch-configure.html#win-fast-launch-with-template). + + * If you don't use a custom launch template to configure your settings, you must attach the [EC2FastLaunchFullAccess](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-iam-awsmanpol-EC2FastLaunchFullAccess.html) policy to the IAM role that Image Builder uses to create your image. When you create a pipeline or use the create-image command in the AWS CLI, you can only specify one Image Builder execution role. If you have defined an Image Builder workflow execution role, you would add any additional feature permissions to that role. Otherwise, you would create a new custom role that includes the required permissions. + +Then, when Image Builder copies your image, EC2 Fast Launch automatically creates an AWS CloudFormation stack with the following resources in your AWS account. + + * A virtual private cloud (VPC) + + * Private subnets across multiple Availability Zones + + * A launch template configured with Instance Metadata Service Version 2 (IMDSv2) + + * A security group with no inbound or outbound rules + + + + +###### Note + +Image Builder doesn't support cross-account distribution for AMIs with EC2 Fast Launch pre-enabled. EC2 Fast Launch must be enabled from the destination account. + @@ -314 +352 @@ For more detailed information, see **[update-distribution-configuration](https:/ -## Create distribution settings to enable EC2 Fast Launch for output AMIs +## Example: Enable EC2 Fast Launch with a launch template for output AMIs @@ -316 +354 @@ For more detailed information, see **[update-distribution-configuration](https:/ -The following example shows how to use the **[create-distribution-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/imagebuilder/create-distribution-configuration.html)** command to create distribution settings that have EC2 Fast Launch configured for your AMI, from the AWS CLI. +The following example shows how to use the **[create-distribution-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/imagebuilder/create-distribution-configuration.html)** command with a launch template to create distribution settings that have EC2 Fast Launch configured for your AMI, from the AWS CLI. @@ -318,3 +356 @@ The following example shows how to use the **[create-distribution-configuration] -###### Note - -Image Builder doesn't support cross-account distribution for AMIs with EC2 Fast Launch pre-enabled. EC2 Fast Launch must be enabled from the destination account. +To configure EC2 Fast Launch settings without a launch template, ensure that you've met all of the EC2 Fast Launch prerequisites before you create your distribution configuration. @@ -378 +414 @@ For more detailed information, see **[create-distribution-configuration](https:/ -## Create distribution settings for output VM disks from the AWS CLI +## Example: Create distribution settings for output VM disks from the AWS CLI