Skip to main content

Remediation

  1. Verify the finding. Confirm the instance's source AMI, its owner, deprecation time, and reason for deprecation. Assess the installed OS and application support separately; AMI deprecation alone does not establish OS end of support.
  2. Choose and test a replacement. Select an available, non-deprecated AMI from a trusted publisher. Test a replacement instance for compatibility with the workload's architecture, drivers, licensing, security configuration, and application dependencies. Confirm the image's support lifecycle.
  3. Prepare the migration. Back up required data and configuration, verify restoration, and test migration and rollback procedures. Preserve required IAM instance profiles, security groups, network settings, storage, encryption, and bootstrap configuration. Plan a maintenance window if the rollout could interrupt service.
  4. Update deployment configuration. Reference the tested AMI in the relevant launch template, Auto Scaling group, infrastructure-as-code definition, or image pipeline. For Auto Scaling groups, select the tested launch-template version and replace instances through the established instance refresh process. Updating deployment configuration does not replace existing instances automatically.
  5. Replace standalone instances. Launch replacements through the normal deployment process, migrate required data, verify workload health, and drain traffic before retiring the original instances. Stopping and restarting an instance does not change its source AMI.
  6. Confirm completion. Verify application health, the replacement instances' AMI IDs, and subsequent launches from the updated deployment configuration. Reevaluate the policy after the next CMDB collection. Retain required backups and the tested rollback path until acceptance; rolling back to the original image reintroduces the deprecated AMI.

If the image remains suitable for the workload, review its deprecation schedule with the owner and document any approved exception. Only the owner can cancel deprecation, and cancellation does not update or patch the image. AWS applies a default two-year deprecation schedule to public AMIs; do not change image sharing solely to clear a finding. For shared images, request a maintained replacement from the publisher.