AWS imagebuilder documentation change

Service: imagebuilder · 2026-01-25 · Documentation low

File: imagebuilder/latest/userguide/wfdoc-step-actions.md

Summary

Added max timeout values for multiple step actions; updated default timeouts for 'Run Document' and 'Register AMI' steps; added IAM permissions requirements for 'Register AMI' and 'Wait for Action' steps; clarified tag merging behavior in 'Register AMI'; corrected output key for 'Check SSM Agent' step.

Security assessment

Added IAM permissions documentation helps users implement least-privilege access for 'Register AMI' (ec2:DescribeSnapshots, ec2:CreateTags) and 'Wait for Action' (lambda:InvokeFunction) operations. This promotes security best practices but doesn't address a specific vulnerability. Clarified tag precedence in AMI registration reduces misconfiguration risks. Timeout increases improve operational reliability but don't directly relate to security vulnerabilities.

Diff

diff --git a/imagebuilder/latest/userguide/wfdoc-step-actions.md b/imagebuilder/latest/userguide/wfdoc-step-actions.md
index e2fb84242..eec173508 100644
--- a//imagebuilder/latest/userguide/wfdoc-step-actions.md
+++ b//imagebuilder/latest/userguide/wfdoc-step-actions.md
@@ -141,0 +142,2 @@ The bootstrap script installs the AWS CLI and Docker packages that are prerequis
+**Max Timeout:** 720 minutes
+
@@ -185,0 +188,2 @@ This step action only works for images that create AMIs.
+**Max Timeout:** 720 minutes
+
@@ -222,0 +227,2 @@ If Amazon Inspector is enabled for your account and image scanning is enabled fo
+**Max Timeout:** 720 minutes
+
@@ -260,0 +267,2 @@ This step action creates an image from a running instance with the Amazon EC2 `C
+**Max Timeout:** 3 days
+
@@ -358,0 +367,2 @@ Image Builder uses the **sendCommand** in the Systems Manager API to run compone
+**Max Timeout:** 1 day
+
@@ -414,0 +425 @@ executionArn | The ARN of the state machine execution. | String
+output | The output of the state machine execution. | String  
@@ -468 +479,3 @@ The `waitFor` input configures the condition that satisfies the step completion
-**Default Timeout:** 60 minutes
+**Default Timeout:** 75 minutes
+
+**Max Timeout:** 720 minutes
@@ -558 +571,3 @@ This step action registers a new Amazon Machine Image (AMI) using the Amazon EC2
-**Default Timeout:** 720 minutes
+**Default Timeout:** 540 minutes
+
+**Max Timeout:** 720 minutes
@@ -575,2 +590,2 @@ includeSnapshotTags | Whether to include tags from the first snapshot defined in
-  * Tags from the `SnapshotId` of the first EBS volume in the `blockDeviceMapping` list that contains a `SnapshotId` is merged with the AMI registration tags.
-  * AMI registration tags take precedence over snapshot tags with the same key.
+  * Tags from the `SnapshotId` of the first EBS volume in the `blockDeviceMapping` list that contains a `SnapshotId` is merged with the output AMI tags.
+  * Output AMI tags take precedence over snapshot tags with the same key.
@@ -594,0 +610,13 @@ imageId | The AMI ID of the registered image. | String
+**IAM permissions required**
+
+Your custom execution role must have the following permissions to use this step action:
+
+###### Allow actions
+
+  * `ec2:DescribeSnapshots`
+
+  * `ec2:CreateTags`
+
+
+
+
@@ -653 +681,3 @@ This step action runs a command document for your workflow. Image Builder uses t
-**Default Timeout:** 12 hours
+**Default Timeout:** 720 minutes
+
+**Max Timeout:** 720 minutes
@@ -699,0 +730,2 @@ This step action uses the **sendCommand** in the Systems Manager API to run the
+**Max Timeout:** 720 minutes
+
@@ -739,0 +772,2 @@ Image Builder uses the **sendCommand** in the Systems Manager API to run this sc
+**Max Timeout:** 720 minutes
+
@@ -777,0 +812,2 @@ This step action terminate the instance with the instance id that's passed in as
+**Max Timeout:** 720 minutes
+
@@ -804,0 +841,2 @@ This step action pauses the running workflow and waits to receive an external ac
+**Max Timeout:** 7 days
+
@@ -821,0 +860,20 @@ reason | The reason for the returned action. | String
+**IAM permissions required**
+
+Your custom execution role must have the following permissions to use this step action:
+
+###### Allow actions
+
+  * `lambda:InvokeFunction`
+
+
+
+
+###### Specify resources
+
+  * `arn:aws:lambda:`us-west-2`:`111122223333`:function:`function-name``
+
+  * `arn:aws:lambda:`us-west-2`:`111122223333`:function:*`
+
+
+
+
@@ -872 +930 @@ Output name | Description | Type
-Status | Connection status of SSM Agent. | String  
+status | Connection status of SSM Agent. | String  
@@ -882 +940 @@ Specify the step action in the workflow document.
-      timeoutInSeconds: 900 # 15 minutes
+      timeoutInSeconds: 900