AWS imagebuilder medium security documentation change
Summary
Added three new feature release entries: AMI watermarks, macOS post-build clean up script correction, and EC2ImageBuilderExecutionPolicy IAM policy. Corrected action module name from 'ExecuteDocument' to 'Assert' and updated section title.
Security assessment
The macOS post-build clean up script correction explicitly addresses security by fixing improper SSH key removal that could leave sensitive credentials in images. The new IAM policy adds security documentation for execution roles. These changes directly impact security posture by preventing credential leakage and improving access control.
Diff
diff --git a/imagebuilder/latest/userguide/doc-history.md b/imagebuilder/latest/userguide/doc-history.md index f21b7b97a..d3fdc1ab1 100644 --- a//imagebuilder/latest/userguide/doc-history.md +++ b//imagebuilder/latest/userguide/doc-history.md @@ -17,0 +18,3 @@ Change| Description| Date +Feature release: AMI watermarks| Image Builder supports AMI watermarks for tracking image lineage. You can specify watermark names in your image recipe, and Image Builder automatically attaches them to output AMIs during the build process. Watermarks propagate automatically when you copy or distribute AMIs across Regions or accounts. For more information, see [Track AMI lineage with watermarks](https://docs.aws.amazon.com/imagebuilder/latest/userguide/ami-watermarks.html).| June 22, 2026 +macOS post-build clean up script correction| Corrected the macOS [Required post-build clean up](https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html#post-build-cleanup) script, which previously contained Linux-specific logic. The script now runs `ec2-macos-init clean -all`, removes macOS SSH keys from `/Users` and `/var/root`, and uses macOS file paths. Added the [Override the macOS clean up script](https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html#override-macos-cleanup-script) reference.| June 12, 2026 +IAM policy release: execution policy| Image Builder added the new `EC2ImageBuilderExecutionPolicy` AWS managed policy. You can attach this policy to a custom IAM role that you pass to Image Builder as an execution role, instead of passing the service-linked role. For more information, see the [EC2ImageBuilderExecutionPolicy](https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-iam-awsmanpol.html#sec-iam-manpol-EC2ImageBuilderExecutionPolicy) policy.| June 4, 2026 @@ -43 +46 @@ Feature release: macOS support| Added support for macOS images.| October 22, 202 -[Added Assert action module](./toe-action-modules.html)| Added documentation for the `ExecuteDocument` action module under `General execution`.| August 14, 2024 +[Added Assert action module](./toe-action-modules.html)| Added documentation for the `Assert` action module under `General execution`.| August 14, 2024 @@ -105 +108 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Troubleshoot Image Builder +Troubleshoot with AI