Policy Packs

guardrails-samples

Prevent use of potentially vulnerable or malicious images, ensuring that only vetted and compliant resources are deployed.

Deny AWS EC2 Instances with Unapproved AMIs or Publisher Accounts

main

aws_ec2_permissions_lockdown_instance_image

Configure whether lockdown policies are enabled to prohibit launching&#92;ninstance from unapproved AMIs. If enabled, instances will only be&#92;nallowed to be launched if they are trusted, per the `AMI IDs` and/or&#92;n`Publishers` sub-policies.&#92;n

ec2PermissionsLockdownInstanceImage

AWS > EC2 > Permissions > Lockdown > Instance > Image

aws_ec2_permissions_lockdown_instance_image_ami_ids

A list of AMI IDs that are approved to be used to launch EC2 Instances.&#92;nThe &#39;*&#39; wildcard may be used to allow all AMIs&#92;nExamples:&#92;n    - ami-ff81a385&#92;n    - ami-12345678&#92;n

ec2PermissionsLockdownInstanceImageAmiIds

AWS > EC2 > Permissions > Lockdown > Instance > Image > AMI IDs

aws_ec2_permissions_lockdown_instance_image_publishers

A list of AWS Account ids who&#39;s images may be used to launch EC2 Instances.&#92;nThis list may contain:&#92;n  - AWS Account IDs - Approve all images from the specified account&#92;n  - `local` - Approve local images (where the `OwnerId` is the account id of the targeted instance)&#92;n  - `amazon` - Approve amazon images (where imageowneralias == `amazon`)&#92;n  - `aws-marketplace` - Approve marketplace images (where imageowneralias == `aws-marketplace`)&#92;nThe &#39;*&#39; wildcard may be used to allow all AMIs from all publishers&#92;nExamples:&#92;n    - amazon         # allow all images with `amazon` ImageOwnerAlias&#92;n    - 102837901569   # Allow all images from AWS Account 102837901569&#92;n    - local          # Allow all local images&#92;n

ec2PermissionsLockdownInstanceImagePublishers

AWS > EC2 > Permissions > Lockdown > Instance > Image > Publishers

turbot_policy_setting.aws_ec2_permissions_lockdown_instance_image

turbot_policy_setting.aws_ec2_permissions_lockdown_instance_image_ami_ids

turbot_policy_setting.aws_ec2_permissions_lockdown_instance_image_publishers

Policy	Setting	Note
AWS > EC2 > Permissions > Lockdown > Instance > Image	Lockdown Disabled
AWS > EC2 > Permissions > Lockdown > Instance > Image > AMI IDs	- "ami-12345678" - "ami-87654321"
AWS > EC2 > Permissions > Lockdown > Instance > Image > Publishers	- "123456789012" - "987654321098"

Policy Settings