AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
SCP for AMI. Restriction
I'm working on locking down our AMI usage across our org and need to implement some Service Control Policies. I know AWS has some sample policies floating around for this kind of thing.
Anyone have a solid SCP policy for AMI restrictions they can share? Looking for something that:
- Restricts to approved AMIs only
- Controls cross-account AMI sharing
- Follows AWS best practices
Pretty sure there's an official AWS sample policy for this somewhere, but I'm striking out finding it. Drop it in the comments if you've got it!
- Idioma
- English
feita há um ano643 visualizações
- Mais recentes
- Mais votos
- Mais comentários
AWS offers a feature called "Allowed AMIs" that's specifically designed for controlling AMI usage across your organization. This is likely a better approach than using Service Control Policies (SCPs) for this particular use case.
Allowed AMIs is an account-wide setting that lets you limit which AMIs can be discovered and used within your AWS accounts. You can specify AMI owner accounts or owner aliases that are permitted, and only AMIs from these owners will be visible and available for launching EC2 instances.
Key benefits of using Allowed AMIs include:
-
Compliance and security: Users can only discover and use AMIs that meet your specified criteria, reducing the risk of non-compliant AMI usage.
-
Efficient management: By reducing the number of allowed AMIs, managing them becomes easier.
-
Centralized implementation: You can configure Allowed AMIs settings at the account level, either directly within the account or through a declarative policy.
You can apply this setting across AWS Organizations and Organizational Units using Declarative Policies, which allows you to manage and enforce this setting at scale. The feature also supports an audit mode to identify EC2 instances launched using AMIs not permitted by your settings before fully applying restrictions.
For controlling cross-account AMI sharing, you might still want to use SCPs or Resource Control Policies (RCPs) as complementary controls, but the Allowed AMIs feature would handle most of your requirements for restricting to approved AMIs only.
When deciding between policy types:
- Use declarative policies (like Allowed AMIs) for enforcing configuration settings
- Use SCPs when you need to restrict IAM principal permissions
- Use RCPs when you need to control access to your resources from external principals
Sources
Control the discovery and use of AMIs in Amazon EC2 with Allowed AMIs - Amazon Elastic Compute Cloud
Enforcing enterprise-wide preventive controls with AWS Organizations | AWS Cloud Operations Blog
Amazon EC2 introduces Allowed AMIs to enhance AMI governance - AWS
respondido há um ano
