8.1 Golden Images with EC2 Image Builder & Amazon ECR

8.1 Golden Images with EC2 Image Builder & Amazon ECR

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to automate golden image creation, enforce security baselines with EC2 Image Builder, manage cross-account and cross-Region AMI distribution, secure container registries with Amazon ECR tag immutability and lifecycle policies, and detect vulnerabilities using basic and enhanced Amazon Inspector scanning.

EC2 Image Builder Architecture & Pipelines

Modern cloud operations mandate immutable infrastructure patterns where machine images (AMIs) and container images are standardized, hardened, and tested before deployment. AWS EC2 Image Builder provides an automated pipeline service to produce and validate golden AMIs and container images without custom maintenance scripts.

An Image Builder pipeline orchestrates three core resources:

1. Image Recipe (or Container Recipe): Combines a base operating system image with build and test components.
2. Infrastructure Configuration: Defines compute capacity, VPC networking, and IAM permissions used to run the build.
3. Distribution Configuration: Defines target AWS accounts, AWS Organizations Organizational Units (OUs), and AWS Regions receiving the final image.

Recipe Components: Build and Test Phases

An Image Recipe pairs a parent image (e.g., Amazon Linux 2023 or Windows Server) with declarative YAML Components across three sequential phases:

• Build Phase: Installs software, CloudWatch and Systems Manager agents, and executes CIS benchmarks or DISA STIG hardening scripts.
• Validate Phase: Verifies software installations and service states.
• Test Phase: Executes automated smoke and security tests (e.g., InSpec, OpenSCAP).

If any test step returns a non-zero exit code, Image Builder aborts the pipeline, marks the build as failed, and terminates the worker instance, preventing defective images from publishing.

---

Infrastructure Configuration & Build Environment

The Infrastructure Configuration dictates the temporary EC2 worker environment:

• Compute & Networking: Defines instance type (e.g., t3.medium), VPC subnet, and security group. In private subnets, VPC endpoints for Systems Manager (ssm, ssmmessages, ec2messages) and S3 are mandatory, as Image Builder orchestrates builds via Systems Manager Run Command.
• IAM Instance Profile: Attaches an IAM role containing EC2InstanceProfileForImageBuilder and AmazonSSMManagedInstanceCore.
• S3 Logging: Directs component logs and console outputs to an S3 bucket for auditing.

---

Distribution Configuration & KMS Re-Encryption

The Distribution Configuration defines multi-account and multi-Region distribution:

• Target Regions: Replicates finalized AMIs to destination Regions, assigning regional AMI IDs while preserving metadata and tags.
• Launch Permissions: Grants specific AWS account IDs or an entire AWS Organizations OU rights to launch instances from the distributed AMI.
• KMS Key Re-Encryption: Encrypts EBS snapshots in target accounts and Regions.

[!IMPORTANT] EBS snapshots encrypted with default AWS-managed KMS keys (aws/ebs) cannot be shared cross-account. To distribute encrypted AMIs to member accounts, the distribution configuration must specify destination KMS Customer Managed Keys (CMKs), and destination key policies must permit Image Builder to create grants and re-encrypt snapshots.

---

Image Pipeline Execution Triggers

Image Pipelines support three execution trigger patterns:

1. Manual Execution: Triggered on demand via the console, AWS CLI (aws imagebuilder start-image-pipeline-execution), or CI/CD pipelines.
2. Schedule Expressions: Automated recurring builds defined via cron or rate expressions (e.g., weekly builds for OS security patches).
3. Event-Driven Triggers via Amazon EventBridge: Executes automatically when upstream base AMIs are updated by AWS or when vulnerability alerts trigger remediation workflows.

---

Amazon Elastic Container Registry (ECR) Governance

Amazon ECR provides a managed OCI container registry requiring strict operational governance.

Tag Immutability

By default, ECR allows tag mutability, allowing tags like latest or v1.2.0 to be overwritten. Enabling Tag Immutability guarantees that pushed tags cannot be altered, rejecting duplicate tags with ImageTagAlreadyExistsException.

ECR Lifecycle Policies

To prevent unbounded storage costs, ECR Lifecycle Policies evaluate declarative JSON rules in priority order:

• Untagged Images: Purges intermediate or untagged images after a set retention window (e.g., 7 days).
• Tagged Image Count: Retains only the last $N$ images matching a prefix (e.g., retaining the 20 most recent prod-* images).
• Tagged Image Age: Expires non-production images (e.g., test-*) older than 30 days.

---

ECR Image Vulnerability Scanning: Basic vs. Enhanced

Amazon ECR offers two vulnerability scanning tiers to secure container images:

Enhanced scanning eliminates the blind spot where an image passes scan-on-push inspection but becomes vulnerable later when a new CVE is published.

---

Cross-Account & Cross-Region ECR Replication

Amazon ECR supports native replication for enterprise architectures:

• Cross-Region Replication: Replicates pushed images to secondary operating Regions, eliminating cross-Region pull latencies and data transfer costs.
• Cross-Account Replication: Synchronizes golden container images from a central build account to member production accounts across AWS Organizations using repository prefix filters (e.g., prod/*).