AWS imagebuilder: Clarify distribution configuration sharing and launch permissions
Summary
Rewrites the Image Builder distribution settings page: renames the resource to 'distribution configuration', clarifies that distribution copies an AMI only into target accounts (not organizations/OUs) and that access for organizations/OUs requires granting launch permission, notes that in a non-build Region the AMI is copied to the owner account only if targetAccountIds is omitted or includes the owner, and refreshes links/formatting.
Security assessment
The changed line documents AMI launch-permission semantics for sharing with accounts, organizations and OUs, and the surrounding edits keep the guidance that setting authorized accounts to 'all' makes an AMI public while correcting the misconception that organizations/OUs receive AMI copies. This is accurate access-control guidance for image sharing rather than a fix for a specific vulnerability, so it is security documentation but not incident-related.
Evidence
* Grant other AWS accounts, organizations, and OUs permission to launch instances from the AMI. The AMI stays in the owner account, and the owner account continues to pay for the AMI's snapshot storage. The accounts that launch instances from the AMI are billed for those instances. For more information about sharing your AMI with AWS Organizations and OUs, see [Share an AMI with organizations and organizational units](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-amis-with-organizations-and-OUs.html).
Diff
diff --git a/imagebuilder/latest/userguide/manage-distribution-settings.md b/imagebuilder/latest/userguide/manage-distribution-settings.md index 9e17b27..77a1fd9 100644 --- a//imagebuilder/latest/userguide/manage-distribution-settings.md +++ b//imagebuilder/latest/userguide/manage-distribution-settings.md @@ -11 +11 @@ Before you configure distribution settings for your output images, we recommend -After you create distribution settings with Image Builder, you can manage them using the Image Builder console, the Image Builder API, or **imagebuilder** commands in the AWS CLI. With distribution settings, you can perform the following actions: +A _distribution configuration_ is a reusable resource that tells Image Builder where and how to deliver the output images that a build produces. You can attach one distribution configuration to a pipeline or to a **CreateImage** request, and you must specify one in a **DistributeImage** request. You manage distribution configurations from the Image Builder console, the Image Builder API, or **imagebuilder** commands in the AWS CLI. With a distribution configuration, Image Builder can perform the following actions: @@ -17 +17 @@ After you create distribution settings with Image Builder, you can manage them u - * Authorize other AWS accounts, organizations, and OUs to launch the AMI from the owner's account. The owner account is billed for charges that are associated with the AMI. + * Grant other AWS accounts, organizations, and OUs permission to launch instances from the AMI. The AMI stays in the owner account, and the owner account continues to pay for the AMI's snapshot storage. The accounts that launch instances from the AMI are billed for those instances. For more information about sharing your AMI with AWS Organizations and OUs, see [Share an AMI with organizations and organizational units](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-amis-with-organizations-and-OUs.html). @@ -21 +21 @@ After you create distribution settings with Image Builder, you can manage them u -To make an AMI public, set the launch permission authorized accounts to `all`. For information and examples, see **[ModifyImageAttribute](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyImageAttribute.html)** in the _Amazon EC2 API Reference_. +To make an AMI public, set the launch permission authorized accounts to `all`. For information and examples, see [ModifyImageAttribute](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyImageAttribute.html) in the _Amazon EC2 API Reference_. @@ -27 +27 @@ You cannot make AMIs with watermarks public. If your image recipe includes water - * Create a copy of the output AMI for each of the specified target accounts, organizations, and OUs in the destination Region. The target accounts, organizations, and OUs own their AMI copies, and are billed for any associated charges. For more information about distributing your AMI to AWS Organizations and OUs, see [Share an AMI with organizations or OUs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/share-amis-with-organizations-and-OUs.html). + * Copy the output AMI into each target account that you specify in the destination Region. Each target account owns its copy of the AMI, and is billed for any associated charges. Organizations and OUs don't receive copies. To give them access, grant launch permission instead. @@ -29 +29 @@ You cannot make AMIs with watermarks public. If your image recipe includes water - * Copy the AMI to the owner's account in other AWS Regions. + * Copy the AMI to the owner's account in other AWS Regions. In a Region other than the one where the build runs, Image Builder copies the AMI to the owner's account only if you omit `targetAccountIds` or include the owner's account ID in it. @@ -51 +51 @@ You can use your distribution settings in the following ways to deliver images t - * The **[CreateImage](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImage.html)** action in the Image Builder API. + * The [CreateImage](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImage.html) action in the Image Builder API. @@ -53 +53 @@ You can use your distribution settings in the following ways to deliver images t - * The **[create-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/imagebuilder/create-image.html)** command in the AWS CLI. + * The [create-image](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/imagebuilder/create-image.html) command in the AWS CLI. @@ -65,0 +66,2 @@ When you have multiple resources of the same type, tagging helps you to identify + * [How distribution settings work](./distribution-settings-concepts.html) + @@ -89 +91 @@ AWS PrivateLink VPC endpoints -List and view distribution configurations +How distribution settings work