EC2 AMIs Should Not Be Public

Using Console

Sure, here are the steps to remediate the issue of EC2 AMIs being public in AWS using the AWS console:

Login to your AWS console.
Go to the EC2 dashboard.
Click on the “AMIs” option in the left-hand menu.
Select the AMI that you want to remediate.
Click on the “Modify Image Permissions” button.
In the “Modify Image Permissions” dialog box, select “Private” as the new permission.
Click on the “Save” button to apply the new permission.
Repeat the above steps for all the public AMIs that you want to remediate.
Once you have changed the permissions for all the public AMIs, verify that they are no longer public by checking the “Permissions” column in the AMIs dashboard.
If any AMIs are still public, repeat the above steps for those AMIs.

By following the above steps, you can remediate the issue of EC2 AMIs being public in AWS and ensure that your AMIs are only accessible to authorized users.

Using CLI

To remediate the misconfiguration “EC2 AMIs Should Not Be Public” for AWS using AWS CLI, follow these steps:

Log in to your AWS account and open the AWS CLI.
Run the following command to check if there are any public AMIs in your AWS account:
aws ec2 describe-images --owners self --filters "Name=is-public,Values=true"
If there are any public AMIs, you can make them private by running the following command:
aws ec2 modify-image-attribute --image-id <image-id> --launch-permission "{\"Remove\": [{\"Group\":\"all\"}]}"
Replace <image-id> with the ID of the AMI you want to make private.
After running the command, verify that the AMI is no longer public by running the following command:
aws ec2 describe-images --owners self --filters "Name=image-id,Values=<image-id>" "Name=is-public,Values=false"
Replace <image-id> with the ID of the AMI you just made private.
Repeat steps 3-4 for all public AMIs in your AWS account.
Once you have made all the necessary AMIs private, you can prevent future public AMIs by setting the default AMI permissions to private. Run the following command:
aws ec2 modify-image-attribute --attribute launchPermission --value "{\"Add\": [{\"Group\":\"self\"}]}" --image-id ami-00000000000000000
Replace ami-00000000000000000 with the ID of any private AMI in your account.
After running the command, verify that the default AMI permissions have been set to private by running the following command:
aws ec2 describe-image-attribute --attribute launchPermission --image-id ami-00000000000000000
Replace ami-00000000000000000 with the ID of the AMI you used in step 6.

By following these steps, you can remediate the “EC2 AMIs Should Not Be Public” misconfiguration for AWS using AWS CLI.

Using Python

To remediate the issue of EC2 AMIs being public in AWS using Python, you can follow the below steps:Step 1: Identify the public EC2 AMIs in your AWS account using boto3 library in Python.

import boto3

ec2 = boto3.client('ec2')

response = ec2.describe_images(
    Filters=[
        {
            'Name': 'is-public',
            'Values': [
                'true',
            ]
        },
    ]
)

for image in response['Images']:
    print('Public AMI ID: ' + image['ImageId'])

Step 2: Deregister the public EC2 AMIs using the deregister_image() method.

import boto3

ec2 = boto3.client('ec2')

response = ec2.describe_images(
    Filters=[
        {
            'Name': 'is-public',
            'Values': [
                'true',
            ]
        },
    ]
)

for image in response['Images']:
    print('Deregistering public AMI ID: ' + image['ImageId'])
    ec2.deregister_image(ImageId=image['ImageId'])

Step 3: Modify the EC2 AMI permissions to make them private using the modify_image_attribute() method.

import boto3

ec2 = boto3.client('ec2')

response = ec2.describe_images(
    Filters=[
        {
            'Name': 'is-public',
            'Values': [
                'true',
            ]
        },
    ]
)

for image in response['Images']:
    print('Making private AMI ID: ' + image['ImageId'])
    ec2.modify_image_attribute(
        ImageId=image['ImageId'],
        LaunchPermission={
            'Remove': [
                {
                    'Group': 'all',
                },
            ],
        },
    )

Note: Before making any changes to your AWS account, it is recommended to test the code in a non-production environment and ensure that it is working as expected.

Using Terraform

resource "aws_ami" "PRIVATE_AMI" {
  name                = "PRIVATE_AMI_NAME"        # replace with your AMI name
  description         = "PRIVATE_AMI_DESCRIPTION" # optional
  virtualization_type = "hvm"
  root_device_name    = "/dev/xvda"

  ebs_block_device {
    device_name = "/dev/xvda"
    volume_size = 20
  }

  # IMPORTANT: Do NOT set any public launch permissions (no "all" group here).
  # Any existing `group = "all"` launch permission must be removed in Terraform.
}

# OPTIONAL: If you need to share this AMI with specific AWS accounts (still not public),
# use aws_ami_launch_permission and ONLY specify account_ids, never group = "all".
resource "aws_ami_launch_permission" "PRIVATE_AMI_PERMISSIONS" {
  image_id = aws_ami.PRIVATE_AMI.id

  # List of AWS account IDs that are allowed to launch this AMI
  account_ids = [
    "ALLOWED_ACCOUNT_ID_1",
    "ALLOWED_ACCOUNT_ID_2",
  ]
}

If you currently have a aws_ami_launch_permission (or an inline launch_permission in older configs) with group = "all", remove that argument/block so Terraform will drop the public launch permission, making the AMI private.
This change does not force replacement of the AMI; it updates the AMI’s launch permissions in place.

Verification: terraform plan should show the group = "all" launch permission being removed (or no longer present) for the affected AMI, with an in-place update to permissions and no AMI replacement.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

EC2 AMIs Should Not Be Public

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: