AWS imagebuilder: Cross-account AMI distribution doc wording and retry guidance updates
Summary
Editorial rewording of cross-account AMI distribution guidance (console/CLI headings, intro sentence), addition of a note about retrying a failed distribution after fixing a missing role or key policy, and removal of a sentence stating the Principal section contains the destination account number from the KMS inline policy step.
Security assessment
The change is primarily editorial but touches cross-account distribution which relies on IAM roles and KMS key policies. The added note guides users to fix missing role/key policy configuration before retrying, which is security-adjacent hardening guidance rather than addressing a specific vulnerability. No CVE or incident is referenced, so it is not security_issue_related.
Evidence
+If a cross-account distribution fails because of a missing role or key policy, fix the configuration and then retry the image. If the image failed during its distribution phase, Image Builder reruns that phase without rebuilding the image. For more information, see [Retry a failed image](./distribution-enhanced_functionality.html#distribution-retry).
Diff
diff --git a/imagebuilder/latest/userguide/cross-account-dist.md b/imagebuilder/latest/userguide/cross-account-dist.md index 063ed16..68e4617 100644 --- a//imagebuilder/latest/userguide/cross-account-dist.md +++ b//imagebuilder/latest/userguide/cross-account-dist.md @@ -7 +7 @@ -Prerequisites for cross-account AMI distributionLimits for cross-account distributionConfigure cross-account distribution for an Image Builder AMI from the consoleConfigure cross-account distribution for an Image Builder AMI from the AWS CLI +Prerequisites for cross-account AMI distributionLimits for cross-account distributionConfigure cross-account distribution for an Image Builder AMI in the consoleConfigure cross-account distribution for an Image Builder AMI from the AWS CLI @@ -11 +11 @@ Prerequisites for cross-account AMI distributionLimits for cross-account distrib -This section describes how you can configure distribution settings to deliver an Image Builder AMI to other accounts that you specify. +You can configure distribution settings that deliver an Image Builder AMI to other accounts that you specify. @@ -30,0 +31,2 @@ When Image Builder performs cross-account distribution for encrypted AMIs, the i +If a cross-account distribution fails because of a missing role or key policy, fix the configuration and then retry the image. If the image failed during its distribution phase, Image Builder reruns that phase without rebuilding the image. For more information, see [Retry a failed image](./distribution-enhanced_functionality.html#distribution-retry). + @@ -111 +113 @@ For more information about trust policies, see [Resource-Based Policies](https:/ - 4. If the AMI you distribute is encrypted, the destination account owner must add the following inline policy to the `EC2ImageBuilderDistributionCrossAccountRole` in their account so that they can use your KMS keys. The `Principal` section contains their account number. This enables Image Builder to act on their behalf when it uses AWS KMS to encrypt and decrypt the AMI with the appropriate keys for each Region. + 4. If the AMI you distribute is encrypted, the destination account owner must add the following inline policy to the `EC2ImageBuilderDistributionCrossAccountRole` in their account so that they can use your KMS keys. This enables Image Builder to act on their behalf when it uses AWS KMS to encrypt and decrypt the AMI with the appropriate keys for each Region. @@ -237 +239 @@ For more information, see [CreateDistributionConfiguration](https://docs.aws.ama -## Configure cross-account distribution for an Image Builder AMI from the console +## Configure cross-account distribution for an Image Builder AMI in the console