AMI shared with multiple accounts

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-aws-ami-shared-with-multiple-accounts

Provider: AWS

Platform: Ansible

Severity: Medium

Category: Access Control

Learn More

Description

AMIs must not be broadly shared. Granting multiple AWS accounts or group-based access increases the attack surface and can expose embedded credentials, custom configurations, or vulnerable images to unintended parties.

For Ansible tasks using the amazon.aws.ec2_ami or ec2_ami modules, launch_permissions should be restricted to at most one explicit AWS account and must not include group_names. This rule flags tasks where launch_permissions.group_names is present or where launch_permissions.user_ids contains more than one entry.

Secure example with a single allowed account:

- name: Register AMI with restricted launch permissions
  amazon.aws.ec2_ami:
    name: my-ami
    image_id: ami-0123456789abcdef0
    launch_permissions:
      user_ids:
        - "123456789012"

Compliant Code Examples

- name: Allow AMI to be launched by another account V2
  amazon.aws.ec2_ami:
    name: my-ami
    image_id: '{{ instance.image_id }}'
    state: present
    launch_permissions:
      user_ids: ['123456789012']

Non-Compliant Code Examples

- name: Update AMI Launch Permissions, making it public
  amazon.aws.ec2_ami:
    name: my-ami
    image_id: "{{ instance.image_id }}"
    state: present
    launch_permissions:
      group_names: ['all']
- name: Allow AMI to be launched by another account
  amazon.aws.ec2_ami:
    name: my-ami
    image_id: "{{ instance.image_id }}"
    state: present
    launch_permissions:
      user_ids: ['123456789012', '121212']