Skip to main content

🛡️ AWS EC2 Image auto-provisioning status🟢

Stats​

not available

Logic​

Description​

Open File

Description​

Identify AWS EC2 AMIs that appear to be associated with AWS-managed backup, lifecycle, or provisioning workflows.

This policy checks for AWS-managed tag signals that can help identify an AMI as associated with AWS Backup, Amazon Data Lifecycle Manager, or AWS Service Catalog.

Rationale​

AWS-managed tags can provide evidence that an AMI was created or managed by an automated AWS workflow. This allows to distinguish AMIs with supported AWS-managed provisioning indicators from AMIs that are not identified by this tag-based method.

Audit​

This policy classifies an AWS EC2 AMI as identified by automated provisioning evidence when the AMI has one of the following supported tag signals:

  • aws:backup:source-resource
  • All of these Amazon Data Lifecycle Manager tags together:
    • aws:dlm:lifecycle-policy-id
    • aws:dlm:lifecycle-schedule-name
    • dlm:managed
  • One of the AWS Service Catalog AutoTags:
    • aws:servicecatalog:portfolioArn
    • aws:servicecatalog:productArn
    • aws:servicecatalog:provisioningPrincipalArn

... see more

Remediation​

Open File

Review​

Review the EC2 AMI and confirm whether it is associated with an expected automated provisioning, backup, lifecycle, or catalog workflow.

If the AMI was intentionally created or managed outside these AWS-managed workflows, record the appropriate ownership and provisioning context. If the AMI appears to be associated with AWS Backup, Amazon Data Lifecycle Manager, or AWS Service Catalog, validate the source workflow and confirm that the AMI is still needed.

policy.yaml​

Open File