AWS imagebuilder documentation change
Summary
Updated documentation for EC2 Image Builder lifecycle policies to emphasize automation of image deprecation/deletion, added details about daily policy execution, rephrased benefits for clarity, strengthened cost savings section, and added caution about downstream dependencies.
Security assessment
Changes focus on operational improvements and cost optimization through automated lifecycle management. While removing outdated images reduces potential security risks from unpatched systems, there's no evidence of addressing a specific vulnerability. The compliance risk mention refers to general operational compliance, not security vulnerabilities.
Diff
diff --git a/imagebuilder/latest/userguide/manage-image-lifecycles.md b/imagebuilder/latest/userguide/manage-image-lifecycles.md index 4813d11f2..12c9df98d 100644 --- a//imagebuilder/latest/userguide/manage-image-lifecycles.md +++ b//imagebuilder/latest/userguide/manage-image-lifecycles.md @@ -9 +9 @@ -When you create custom images, it's important that you have a plan to retire those images before they become obsolete. Image Builder pipelines can apply updates and security patches automatically. However, each build creates a new version of the image and all of the associated resources that it distributes. Earlier versions remain in your account until you manually delete them, or create a script to perform the task. +EC2 Image Builder lifecycle policies automate deprecation, disabling, and deletion of outdated images and their associated resources. Each pipeline build creates a new image version and distributes associated resources. Without lifecycle policies, earlier versions remain in your account until you delete them manually. @@ -11 +11,3 @@ When you create custom images, it's important that you have a plan to retire tho -With Image Builder lifecycle management policies, you can automate the process of deprecating, disabling, and deleting outdated images and their associated resources. Associated resources can include output images that you've distributed to other AWS accounts, organizations, and organizational units (OUs) across AWS Regions. You define the rules for how and when to take each step in the lifecycle process, and which steps to include in your policy. +Lifecycle policies define rules that control when and how Image Builder retires outdated images. Associated resources include output images distributed to other AWS accounts, organizations, and organizational units (OUs). These resources can span multiple AWS Regions. You specify which lifecycle steps to include and when each step runs. + +Enabled lifecycle policies run automatically once per day. Image Builder manages the execution schedule. For execution details, see [How lifecycle policy execution works](./lifecycle-policy-execution.html). @@ -15 +17 @@ With Image Builder lifecycle management policies, you can automate the process o -Overall benefits of automated lifecycle management include the following: +Automated lifecycle management: @@ -17 +19 @@ Overall benefits of automated lifecycle management include the following: - * Simplifies lifecycle management for your custom images with an automated way to retire images and associated resources. + * Automates retirement of images and their associated resources across accounts and Regions. @@ -19 +21 @@ Overall benefits of automated lifecycle management include the following: - * Helps to prevent compliance risks that come from using outdated images to launch new instances. + * Eliminates compliance risks from launching new instances with outdated images. @@ -21 +23 @@ Overall benefits of automated lifecycle management include the following: - * Keeps image inventories fresh by removing outdated images. + * Maintains fresh image inventories by removing obsolete versions. @@ -23 +25 @@ Overall benefits of automated lifecycle management include the following: - * Can reduce storage and data transfer costs by optionally removing associated resources for images that are deleted. + * Reduces infrastructure costs by removing associated resources when you delete images. @@ -28 +30 @@ Overall benefits of automated lifecycle management include the following: -###### Realize cost savings +###### Cost savings @@ -30 +32 @@ Overall benefits of automated lifecycle management include the following: -There is no cost to use EC2 Image Builder to create custom AMI or container images. However, standard pricing applies for other services that are used in the process. When you remove unused or outdated images and their associated resources from your AWS account, you can realize time and cost savings in the following ways: +There is no cost to use EC2 Image Builder to create custom AMI or container images. However, standard pricing applies for other services that are used in the process. Removing outdated images and associated resources reduces costs: @@ -32 +34 @@ There is no cost to use EC2 Image Builder to create custom AMI or container imag - * Reduce the time it takes to patch existing images when you're not also patching unused or outdated images. + * Reduces the number of images you need to patch by removing outdated versions. @@ -34 +36 @@ There is no cost to use EC2 Image Builder to create custom AMI or container imag - * For AMI image resources that you delete, you can choose to also remove distributed AMIs and their associated snapshots. This approach can save on the cost of storing snapshots. + * Removes distributed AMIs and their associated snapshots when you delete AMI image resources, eliminating snapshot storage costs. @@ -36 +38 @@ There is no cost to use EC2 Image Builder to create custom AMI or container imag - * For container image resources that you delete, you can choose to delete underlying resources. This approach can save on Amazon ECR storage costs and data transfer rates for your Docker images that are stored in ECR repositories. + * Deletes underlying resources when you delete container image resources, eliminating Amazon ECR storage costs and data transfer charges. @@ -43 +45 @@ There is no cost to use EC2 Image Builder to create custom AMI or container imag -Image Builder can't evaluate the potential impact for all possible downstream dependencies, such as Auto Scaling groups or launch templates. You must consider downstream dependencies for your images when you configure policy actions. +Before you configure policy actions, verify that no downstream dependencies reference images the policy removes. Image Builder does not evaluate the impact on downstream dependencies such as Auto Scaling groups or launch templates. @@ -54,0 +57,2 @@ Image Builder can't evaluate the potential impact for all possible downstream de + * [How lifecycle policy execution works](./lifecycle-policy-execution.html) +