Listen to this Post
An Amazon Machine Image (AMI) serves as a template for launching EC2 instances, containing configurations for the root volume, launch permissions, and block device mappings. AWS provides pre-built AMIs, and third-party options are available in the AWS Marketplace. You can also create custom AMIs using tools like HashiCorp Packer.
Sharing AMIs across AWS accounts requires a specific process. This guide explains how to enable cross-account AMI sharing securely.
🔗 Reference: How to Share AMIs Across AWS Accounts
You Should Know: Practical Steps for AMI Sharing & Management
1. Sharing an AMI with Another AWS Account
To allow another AWS account to use your AMI, follow these steps:
Step 1: Modify AMI Permissions
Run the following AWS CLI command to grant access:
aws ec2 modify-image-attribute \
--image-id ami-1234567890abcdef0 \
--launch-permission "Add=[{UserId=123456789012}]"
Replace:
– `ami-1234567890abcdef0` with your AMI ID.
– `123456789012` with the target AWS account ID.
Step 2: Verify Shared AMI in Target Account
The recipient account can now launch instances using:
aws ec2 run-instances \ --image-id ami-1234567890abcdef0 \ --instance-type t2.micro \ --key-name MyKeyPair
- Creating a Custom AMI with HashiCorp Packer
Automate AMI creation using Packer:
Sample Packer Template (`aws-ami.json`)
{
"builders": [{
"type": "amazon-ebs",
"region": "us-east-1",
"source_ami": "ami-0abcdef1234567890",
"instance_type": "t2.micro",
"ssh_username": "ec2-user",
"ami_name": "custom-linux-ami-{{timestamp}}",
"ami_description": "Custom Linux AMI"
}],
"provisioners": [{
"type": "shell",
"script": "./setup.sh"
}]
}
Run Packer to build the AMI:
packer build aws-ami.json
3. Encrypting AMIs for Security
Ensure AMIs use encryption:
aws ec2 copy-image \ --source-image-id ami-1234567890abcdef0 \ --source-region us-east-1 \ --region us-west-2 \ --encrypted \ --kms-key-id alias/aws/ebs
4. Deregistering Unused AMIs
Clean up old AMIs:
aws ec2 deregister-image --image-id ami-1234567890abcdef0
What Undercode Say
Sharing AMIs across AWS accounts enhances collaboration while maintaining security. Key takeaways:
– Use `modify-image-attribute` for cross-account sharing.
– Automate AMI builds with HashiCorp Packer.
– Always encrypt AMIs for compliance.
– Clean up unused AMIs to avoid unnecessary costs.
For Linux users, managing AMIs via CLI is efficient. Windows admins can use AWS Tools for PowerShell:
Edit-EC2ImageAttribute -ImageId ami-1234567890abcdef0 -Attribute launchPermission -OperationType add -UserId 123456789012
🔗 Further Reading:
Expected Output:
A structured, actionable guide on AWS AMI sharing with verified commands and security best practices.
References:
Reported By: Darryl Ruggles – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
