AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-10-19 · Documentation medium

File: AWSCloudFormation/latest/UserGuide/quickref-ec2-sg.md

Summary

Changed EC2 instance AMI selection to use SSM parameter for latest Amazon Linux 2 AMI

Security assessment

While not directly addressing a security issue, using SSM parameters to retrieve the latest AMI promotes security best practices by ensuring instances launch with up-to-date patched images, reducing vulnerability exposure.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/quickref-ec2-sg.md b/AWSCloudFormation/latest/UserGuide/quickref-ec2-sg.md
index 6a9355db6..29f84146b 100644
--- a//AWSCloudFormation/latest/UserGuide/quickref-ec2-sg.md
+++ b//AWSCloudFormation/latest/UserGuide/quickref-ec2-sg.md
@@ -41 +41 @@ A subnet is created within the VPC using an [AWS::EC2:: Subnet](https://docs.aws
-An EC2 instance is launched within the VPC and subnet using an [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) resource. This resource specifies the Amazon Machine Image (AMI) to use to launch the instance, the subnet where the instance will run, and the security group to associate with the instance. The `Fn::FindInMap` function is used to retrieve values from the `AWSRegionToAMI` mapping defined in the template to determine the `ImageId` for the [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) resource. 
+An EC2 instance is launched within the VPC and subnet using an [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) resource. This resource specifies the Amazon Machine Image (AMI) to use to launch the instance, the subnet where the instance will run, and the security group to associate with the instance. The `ImageId` uses a Systems Manager parameter to dynamically retrieve the latest Amazon Linux 2 AMI. 
@@ -77,9 +77 @@ When you create a VPC using CloudFormation, AWS automatically creates default re
-            "ImageId": {
-                "Fn::FindInMap": [
-                    "AWSRegionToAMI",
-                    {
-                        "Ref": "AWS::Region"
-                    },
-                    "64"
-                ]
-            },
+            "ImageId": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}",
@@ -121,5 +113 @@ When you create a VPC using CloudFormation, AWS automatically creates default re
-        ImageId:
-          Fn::FindInMap:
-            - AWSRegionToAMI
-            - Ref: AWS::Region
-            - "64"
+        ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'