AWS imagebuilder: Document launch template distribution rules and cross-account permissions
Summary
Rewrites the launch template distribution page: consolidates EC2 launch template links, moves the Windows Fast Launch tag note, and adds explicit rules for launchTemplateConfigurations including launchTemplateId uniqueness, setDefaultVersion behavior, cross-account updates via accountId and the EC2ImageBuilderDistributionCrossAccountRole, the launch permission requirement (targetAccountIds/launchPermission userIds/public AMI), and the five-configuration quota.
Security assessment
The added text documents access-control constraints for cross-account AMI distribution: which accounts may receive the AMI (targetAccountIds, launchPermission userIds, or public), that organization/OU-based launch permissions do not satisfy the requirement, and that Image Builder assumes EC2ImageBuilderDistributionCrossAccountRole in the target account. This is security-relevant authorization guidance but does not reference or fix any specific vulnerability or incident.
Evidence
Image Builder rejects the distribution configuration unless the account is listed in `targetAccountIds` or in the `userIds` of `launchPermission` for that Region, or the AMI is public. Launch permission that you grant through `organizationArns` or `organizationalUnitArns` doesn't meet this requirement.
Diff
diff --git a/imagebuilder/latest/userguide/dist-using-launch-template.md b/imagebuilder/latest/userguide/dist-using-launch-template.md index b1d84ba..bf0229f 100644 --- a//imagebuilder/latest/userguide/dist-using-launch-template.md +++ b//imagebuilder/latest/userguide/dist-using-launch-template.md @@ -7 +7 @@ -Add an EC2 launch template to AMI distribution settings from the consoleAdd an EC2 launch template to AMI distribution settings from the AWS CLI +Add an EC2 launch template to AMI distribution settings in the consoleAdd an EC2 launch template to AMI distribution settings from the AWS CLI @@ -11 +11 @@ Add an EC2 launch template to AMI distribution settings from the consoleAdd an E -To help ensure a consistent launch experience for your Image Builder AMI in target accounts and Regions, you can specify an Amazon EC2 launch template in your distribution settings, using `launchTemplateConfigurations`. When `launchTemplateConfigurations` are present during the distribution process, Image Builder creates a new version of the launch template that includes all of the original settings from the template, and the new AMI ID from the build. For more information about launching an EC2 instance using a launch template, see one of the following links, depending on your target operating system. +To help ensure a consistent launch experience for your Image Builder AMI in target accounts and Regions, you can specify an Amazon EC2 launch template in your distribution settings, using `launchTemplateConfigurations`. When `launchTemplateConfigurations` are present during the distribution process, Image Builder creates a new version of the launch template that includes all of the original settings from the template, and the new AMI ID from the build. For more information about launching an EC2 instance using a launch template, see [Launch EC2 instances using a launch template](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launch-instances-from-launch-template.html) in the _Amazon EC2 User Guide_. @@ -13 +13 @@ To help ensure a consistent launch experience for your Image Builder AMI in targ - * [Launch a Linux instance from a launch template](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html) +###### Note @@ -15 +15 @@ To help ensure a consistent launch experience for your Image Builder AMI in targ - * [Launch a Windows instance from a launch template](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html) +When you include a launch template to enable Windows Fast Launch in your image, the launch template must include the following tag so that Image Builder can enable Windows Fast Launch on your behalf. @@ -16,0 +17 @@ To help ensure a consistent launch experience for your Image Builder AMI in targ +`CreatedBy: EC2 Image Builder` @@ -17,0 +19 @@ To help ensure a consistent launch experience for your Image Builder AMI in targ +When you configure `launchTemplateConfigurations`, the following rules apply: @@ -18,0 +21,9 @@ To help ensure a consistent launch experience for your Image Builder AMI in targ + * Identify the launch template by `launchTemplateId`. Within the launch template configurations for a Region, a launch template ID can appear at most once. + + * `setDefaultVersion` controls whether Image Builder makes the new launch template version the default version. This optional field defaults to `true`. To create the new version without changing the launch template's default version, set this field to `false`. + + * Use `accountId` to update a launch template that another account owns. If you omit it, Image Builder updates the launch template in your account. To update a launch template in another account, Image Builder assumes the `EC2ImageBuilderDistributionCrossAccountRole` in that account, in the Region of the distribution. For more information, see [Set up cross-account AMI distribution with Image Builder](./cross-account-dist.html). The new launch template version references the AMI that your account owns in that Region. + +Image Builder rejects the distribution configuration unless the account is listed in `targetAccountIds` or in the `userIds` of `launchPermission` for that Region, or the AMI is public. Launch permission that you grant through `organizationArns` or `organizationalUnitArns` doesn't meet this requirement. + + * You can configure up to five launch template configurations per Region. This is a default service quota that you can request to increase. For more information, see [EC2 Image Builder endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/imagebuilder.html). @@ -20 +30,0 @@ To help ensure a consistent launch experience for your Image Builder AMI in targ -###### Note @@ -22 +31,0 @@ To help ensure a consistent launch experience for your Image Builder AMI in targ -When you include a launch template to enable Windows Fast Launch in your image, the launch template must include the following tag so that Image Builder can enable Windows Fast Launch on your behalf. @@ -24 +32,0 @@ When you include a launch template to enable Windows Fast Launch in your image, -`CreatedBy: EC2 Image Builder` @@ -26 +34 @@ When you include a launch template to enable Windows Fast Launch in your image, -## Add an EC2 launch template to AMI distribution settings from the console +## Add an EC2 launch template to AMI distribution settings in the console