[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"lesson-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-machine-and-container-images-amis-and-ec2-image-builder-en":4,"prev-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-machine-and-container-images-amis-and-ec2-image-builder-en":1008,"next-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-machine-and-container-images-amis-and-ec2-image-builder-en":1022},null,{"locked":5,"reason":3,"meta":6,"item":19},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"AMIs and EC2 Image Builder","What an AMI actually contains, where the line between baking and bootstrapping sits, how an EC2 Image Builder pipeline turns a base image into a tested and distributed golden AMI, and the difference between deprecating, disabling, and deregistering an image.",true,26,"intermediate",[13,14,15,16,17,18],"Describe what an AMI contains and which properties are fixed at creation time","Decide what belongs baked into an image and what belongs in launch-time bootstrapping","Explain the five EC2 Image Builder resources and how a pipeline assembles them into a build","Predict what happens when the test stage of an Image Builder pipeline fails","Compare deprecating, disabling, and deregistering an AMI, and choose the right one for a given requirement","State what is required to share an AMI backed by encrypted snapshots with another account",{"id":20,"title":7,"body":21,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":907,"infographics":908,"isFree":9,"learningObjectives":925,"meta":926,"navigation":9,"path":927,"quiz":928,"seo":1005,"stem":1006,"__hash__":1007},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/01-machine-and-container-images/01-amis-and-ec2-image-builder.md",{"type":22,"value":23,"toc":896},"minimark",[24,28,31,36,39,63,66,72,78,81,85,96,99,176,183,190,197,201,209,212,215,219,222,304,307,325,524,545,550,554,557,562,602,612,615,619,622,636,639,642,646,649,652,674,681,684,688,691,807,819,822,833,844,848,886,889,892],[25,26,27],"p",{},"An Auto Scaling group adds an instance during a traffic spike. The instance boots in about 40 seconds, then spends 8 more minutes in user data: patching the OS, pulling three agents, and compiling a dependency. By the time it passes its health check, the spike is over. Worse, the instance that launched last Tuesday installed slightly different package versions from the one that launched today, because both resolved \"latest\" against a repository that moved in between.",[25,29,30],{},"Both problems have the same fix. Do that work once, before the launch, and store the result as an image.",[32,33,35],"h2",{"id":34},"what-an-ami-actually-is","What an AMI actually is",[25,37,38],{},"An Amazon Machine Image is not a file you can download. It is a record in EC2 that points at one or more EBS snapshots and carries the metadata needed to turn those snapshots into a bootable instance:",[40,41,42,51,57],"ul",{},[43,44,45,46,50],"li",{},"The ",[47,48,49],"strong",{},"block device mapping",": which snapshot becomes the root volume, what size it is, which additional volumes attach, and whether they delete on termination.",[43,52,45,53,56],{},[47,54,55],{},"boot and platform metadata",": architecture (x86_64 or arm64), virtualization type, root device type, and boot mode.",[43,58,59,62],{},[47,60,61],{},"Launch permissions",": which accounts, organizations, or OUs may launch from it.",[25,64,65],{},"Two consequences follow from that structure, and both show up on the exam.",[25,67,68,71],{},[47,69,70],{},"An AMI is Regional."," The snapshots live in one Region, so the AMI ID is meaningful only in that Region. To launch the same image in a second Region you copy it there, and the copy gets a different AMI ID. This is why a CloudFormation template that hardcodes an AMI ID breaks the moment someone deploys it elsewhere.",[25,73,74,77],{},[47,75,76],{},"You do not pay for the AMI, you pay for its snapshots."," The AMI record itself is free. Every AMI you have ever created is quietly billing you for the snapshot storage behind it, which is why the cleanup section at the end of this lesson matters more than it sounds.",[25,79,80],{},"An AMI is also fixed at these properties. You cannot change an x86_64 AMI into an arm64 one, or convert an instance-store-backed AMI into an EBS-backed one. When you need a different combination, you build a new image.",[32,82,84],{"id":83},"bake-or-bootstrap-the-decision-that-shapes-everything-else","Bake or bootstrap: the decision that shapes everything else",[25,86,87,88,91,92,95],{},"Every piece of configuration a server needs can arrive one of two ways. ",[47,89,90],{},"Baking"," puts it in the image at build time. ",[47,93,94],{},"Bootstrapping"," applies it at launch time through user data, a Systems Manager association, or a configuration management tool.",[25,97,98],{},"Nothing forces you to pick one. The useful question is which half of your configuration goes where.",[100,101,102,117],"table",{},[103,104,105],"thead",{},[106,107,108,111,114],"tr",{},[109,110],"th",{},[109,112,113],{},"Bake into the AMI",[109,115,116],{},"Bootstrap at launch",[118,119,120,132,143,154,165],"tbody",{},[106,121,122,126,129],{},[123,124,125],"td",{},"Launch time cost",[123,127,128],{},"Zero, the work already happened",[123,130,131],{},"Paid on every single launch",[106,133,134,137,140],{},[123,135,136],{},"Consistency",[123,138,139],{},"Byte-identical across every instance",[123,141,142],{},"Depends on what upstream repositories serve that minute",[106,144,145,148,151],{},[123,146,147],{},"Changing it",[123,149,150],{},"Rebuild the image and replace instances",[123,152,153],{},"Change the script, next launch picks it up",[106,155,156,159,162],{},[123,157,158],{},"Per-environment values",[123,160,161],{},"Forces a separate image per environment",[123,163,164],{},"Handled naturally",[106,166,167,170,173],{},[123,168,169],{},"Auditability",[123,171,172],{},"One image ID answers \"what is on this box\"",[123,174,175],{},"You have to reconstruct it from logs",[25,177,178,179,182],{},"The decision rule that falls out of that table: ",[47,180,181],{},"bake what is slow and stable, bootstrap what is fast and varies."," OS patches, agents, runtimes, and compiled dependencies are slow and stable, so they belong in the image. The database endpoint, the environment name, and the instance's role in the cluster are fast and vary per deployment, so they belong in user data or Parameter Store.",[25,184,185,186,189],{},"An image built this way is usually called a ",[47,187,188],{},"golden AMI",": a hardened, patched, pre-loaded base that every workload in the organization launches from.",[25,191,192,193,196],{},"Here is the misconception this section exists to kill: ",[47,194,195],{},"\"a golden AMI means everything is in the image.\""," Push it that far and you end up rebuilding an image to change a log level, and maintaining one image per environment per application. The image is a starting line, not a finished server.",[32,198,200],{"id":199},"why-hand-built-golden-amis-stop-working","Why hand-built golden AMIs stop working",[25,202,203,204,208],{},"The first golden AMI is easy. Launch an instance, patch it, install what you need, run ",[205,206,207],"code",{},"create-image",", write the AMI ID in a wiki page.",[25,210,211],{},"The second month is where it falls apart. New CVEs land, so the image needs a rebuild, and the person who built it is on leave and never wrote down step 4. Nobody tested the new image before an Auto Scaling group started launching from it. The image exists in us-east-1 only, and the DR Region needs it too. There is no record of what changed between version 3 and version 4.",[25,213,214],{},"Those failures are not about laziness. They are what happens when a build process lives in someone's memory instead of in a file. EC2 Image Builder exists to move it into files.",[32,216,218],{"id":217},"the-five-image-builder-resources","The five Image Builder resources",[25,220,221],{},"Image Builder splits an image build into five resources, and once you see what each one owns, the service stops feeling large.",[100,223,224,237],{},[103,225,226],{},[106,227,228,231,234],{},[109,229,230],{},"Resource",[109,232,233],{},"Answers the question",[109,235,236],{},"Contains",[118,238,239,252,265,278,291],{},[106,240,241,246,249],{},[123,242,243],{},[47,244,245],{},"Image recipe",[123,247,248],{},"What goes in the image?",[123,250,251],{},"Base image, ordered list of components, instance-level settings such as the root volume size",[106,253,254,259,262],{},[123,255,256],{},[47,257,258],{},"Component",[123,260,261],{},"How is one customization performed?",[123,263,264],{},"An AWSTOE YAML document with phases and steps: install a package, harden a setting, run a test",[106,266,267,272,275],{},[123,268,269],{},[47,270,271],{},"Infrastructure configuration",[123,273,274],{},"Where is the image built?",[123,276,277],{},"Instance types, subnet, security groups, IAM instance profile, SNS topic, S3 log bucket, terminate-on-failure",[106,279,280,285,288],{},[123,281,282],{},[47,283,284],{},"Distribution settings",[123,286,287],{},"Where does the finished image go?",[123,289,290],{},"Target Regions, output AMI name, KMS key, accounts and OUs to share or copy to, launch template configuration",[106,292,293,298,301],{},[123,294,295],{},[47,296,297],{},"Image pipeline",[123,299,300],{},"When does this run?",[123,302,303],{},"A recipe plus an infrastructure configuration plus distribution settings, plus a schedule",[25,305,306],{},"Two of these deserve a closer look.",[25,308,309,312,313,316,317,320,321,324],{},[47,310,311],{},"Components"," are where your actual customization lives. A component is a plain YAML document that AWSTOE runs on the build instance, and it comes in two flavors: ",[47,314,315],{},"build components"," customize the instance before the snapshot, and ",[47,318,319],{},"test components"," validate the instance after it. AWS publishes managed components for common jobs, including ",[205,322,323],{},"update-linux"," and the STIG and CIS hardening sets, and you write your own for anything specific to you.",[326,327,332],"pre",{"className":328,"code":329,"language":330,"meta":331,"style":331},"language-yaml shiki shiki-themes material-theme-lighter github-light github-dark","name: InstallAndVerifyNginx\ndescription: Install nginx and confirm it answers on port 80\nschemaVersion: 1.0\nphases:\n  - name: build\n    steps:\n      - name: InstallNginx\n        action: ExecuteBash\n        inputs:\n          commands:\n            - dnf install -y nginx\n            - systemctl enable nginx\n  - name: validate\n    steps:\n      - name: ConfirmBinary\n        action: ExecuteBash\n        inputs:\n          commands:\n            - nginx -v\n","yaml","",[205,333,334,351,362,374,383,397,405,418,429,437,445,454,462,474,481,493,502,509,516],{"__ignoreMap":331},[335,336,339,343,347],"span",{"class":337,"line":338},"line",1,[335,340,342],{"class":341},"sQzsp","name",[335,344,346],{"class":345},"sP7_E",":",[335,348,350],{"class":349},"s_sjI"," InstallAndVerifyNginx\n",[335,352,354,357,359],{"class":337,"line":353},2,[335,355,356],{"class":341},"description",[335,358,346],{"class":345},[335,360,361],{"class":349}," Install nginx and confirm it answers on port 80\n",[335,363,365,368,370],{"class":337,"line":364},3,[335,366,367],{"class":341},"schemaVersion",[335,369,346],{"class":345},[335,371,373],{"class":372},"srdBf"," 1.0\n",[335,375,377,380],{"class":337,"line":376},4,[335,378,379],{"class":341},"phases",[335,381,382],{"class":345},":\n",[335,384,386,389,392,394],{"class":337,"line":385},5,[335,387,388],{"class":345},"  -",[335,390,391],{"class":341}," name",[335,393,346],{"class":345},[335,395,396],{"class":349}," build\n",[335,398,400,403],{"class":337,"line":399},6,[335,401,402],{"class":341},"    steps",[335,404,382],{"class":345},[335,406,408,411,413,415],{"class":337,"line":407},7,[335,409,410],{"class":345},"      -",[335,412,391],{"class":341},[335,414,346],{"class":345},[335,416,417],{"class":349}," InstallNginx\n",[335,419,421,424,426],{"class":337,"line":420},8,[335,422,423],{"class":341},"        action",[335,425,346],{"class":345},[335,427,428],{"class":349}," ExecuteBash\n",[335,430,432,435],{"class":337,"line":431},9,[335,433,434],{"class":341},"        inputs",[335,436,382],{"class":345},[335,438,440,443],{"class":337,"line":439},10,[335,441,442],{"class":341},"          commands",[335,444,382],{"class":345},[335,446,448,451],{"class":337,"line":447},11,[335,449,450],{"class":345},"            -",[335,452,453],{"class":349}," dnf install -y nginx\n",[335,455,457,459],{"class":337,"line":456},12,[335,458,450],{"class":345},[335,460,461],{"class":349}," systemctl enable nginx\n",[335,463,465,467,469,471],{"class":337,"line":464},13,[335,466,388],{"class":345},[335,468,391],{"class":341},[335,470,346],{"class":345},[335,472,473],{"class":349}," validate\n",[335,475,477,479],{"class":337,"line":476},14,[335,478,402],{"class":341},[335,480,382],{"class":345},[335,482,484,486,488,490],{"class":337,"line":483},15,[335,485,410],{"class":345},[335,487,391],{"class":341},[335,489,346],{"class":345},[335,491,492],{"class":349}," ConfirmBinary\n",[335,494,496,498,500],{"class":337,"line":495},16,[335,497,423],{"class":341},[335,499,346],{"class":345},[335,501,428],{"class":349},[335,503,505,507],{"class":337,"line":504},17,[335,506,434],{"class":341},[335,508,382],{"class":345},[335,510,512,514],{"class":337,"line":511},18,[335,513,442],{"class":341},[335,515,382],{"class":345},[335,517,519,521],{"class":337,"line":518},19,[335,520,450],{"class":345},[335,522,523],{"class":349}," nginx -v\n",[25,525,526,527,530,531,534,535,538,539,541,542,544],{},"The phase names are not decoration. Image Builder decides when a component runs by which phases it defines: a component runs in the build stage if it defines ",[205,528,529],{},"build"," or ",[205,532,533],{},"validate",", and it runs in the test stage if it defines ",[205,536,537],{},"test"," and nothing else. A component cannot straddle the two, and you cannot chain a value produced in ",[205,540,529],{}," into a ",[205,543,537],{}," step, because those stages run on different instances.",[25,546,547,549],{},[47,548,271],{}," is the resource people forget until a build fails. The build instance runs in your VPC, which means it needs a subnet with a route to reach package repositories, a security group that permits that traffic, and an instance profile with the Image Builder permissions. It is also where the troubleshooting switch lives: by default the build instance terminates when a build fails, and turning that off keeps the instance alive so you can log in and read the AWSTOE logs.",[32,551,553],{"id":552},"what-one-pipeline-run-actually-does","What one pipeline run actually does",[25,555,556],{},"Walk one build end to end, because the ordering explains several exam answers.",[558,559],"infographic",{"alt":560,"slug":561},"A pipeline run flows from the image recipe and infrastructure configuration through the build stage to a snapshot, then through the test stage to a pass or fail fork, where only a passing image reaches the distribution settings and the target Regions.","amis-and-ec2-image-builder-pipeline-flow",[563,564,565,577,583,596],"ol",{},[43,566,567,570,571,573,574,576],{},[47,568,569],{},"Build stage."," Image Builder launches an EC2 instance from the base image, inside the subnet from your infrastructure configuration. AWSTOE runs the ",[205,572,529],{}," phase of every build component in recipe order, then the ",[205,575,533],{}," phase of each. If any step fails, the build stops here.",[43,578,579,582],{},[47,580,581],{},"Snapshot."," With the customizations applied, Image Builder stops the instance and takes a snapshot, producing the candidate image.",[43,584,585,588,589,592,593,595],{},[47,586,587],{},"Test stage."," For an AMI workflow, Image Builder launches a ",[47,590,591],{},"new"," instance from that candidate image and runs the ",[205,594,537],{}," phase of every component in the recipe. This is a real launch of the real artifact, not a re-check of the build instance, which is why it catches a first-boot service that fails to start.",[43,597,598,601],{},[47,599,600],{},"Distribution."," Only if every test passed does Image Builder copy the AMI into each Region in your distribution settings, apply the configured KMS key, set launch permissions, and optionally update a launch template to point at the new AMI ID.",[25,603,604,605,530,608,611],{},"That last option is worth pausing on. Distribution can write the new AMI ID into a specific version of an EC2 launch template, so an Auto Scaling group pointed at that template's ",[205,606,607],{},"$Latest",[205,609,610],{},"$Default"," version picks up the new image without anyone editing anything.",[25,613,614],{},"The service itself is free. You pay for the EC2 build and test instances while they run, the EBS snapshots the images occupy, S3 log storage, Amazon Inspector if you turn on vulnerability scanning during the build, and ECR storage for container image outputs.",[32,616,618],{"id":617},"scheduling-build-on-a-clock-or-build-on-a-change","Scheduling: build on a clock, or build on a change",[25,620,621],{},"A pipeline can run on demand, on a cron schedule, or in response to an EventBridge rule. The schedule has a second setting that carries most of the value, and it is a common exam target.",[40,623,624,630],{},[43,625,626,629],{},[47,627,628],{},"Run at the scheduled time, always."," Every scheduled slot produces a build, whether or not anything upstream changed. You get a fresh image on a fixed cadence and pay for a build each time.",[43,631,632,635],{},[47,633,634],{},"Run at the scheduled time only if dependency updates are available."," Image Builder checks whether the base image or any component has a newer semantic version, and skips the build if nothing moved.",[25,637,638],{},"The second option only works if your recipe uses semantic versioning for the base image and components, which in the console means choosing \"use latest available OS version\" and \"use latest version available\" rather than pinning an exact version string. Pin everything to fixed versions and Image Builder has nothing to compare, so it either rebuilds every time or never detects an update, depending on how the recipe is written.",[25,640,641],{},"A weekly pipeline set to build only on dependency updates is the shape most teams want: no image churn during a quiet week, and a fresh patched image the moment AWS publishes a new base AMI.",[32,643,645],{"id":644},"distributing-and-sharing-the-result","Distributing and sharing the result",[25,647,648],{},"Distribution settings handle the cross-Region and cross-account work that people otherwise do by hand.",[25,650,651],{},"Within your own account, distribution copies the AMI into each target Region. Across accounts you have two different options, and the difference is about ownership:",[40,653,654,664],{},[43,655,656,658,659,663],{},[47,657,61],{}," let another account launch from ",[660,661,662],"em",{},"your"," AMI. You still own the image, you still pay for the snapshots, and the other account pays only for the instances it launches. Revoke the permission and their future launches stop.",[43,665,666,669,670,673],{},[47,667,668],{},"Target accounts and OUs"," create a ",[660,671,672],{},"copy"," of the AMI in each target account. That account owns its copy and pays for its snapshots, and the copy survives anything you do to the original.",[25,675,676,677,680],{},"Encryption adds one requirement that trips up more people than any other part of AMI sharing. An AMI whose snapshots are encrypted with the default AWS managed key ",[47,678,679],{},"cannot be shared at all",", because you cannot edit that key's policy. Sharing an encrypted AMI means encrypting its snapshots with a customer managed KMS key and granting the target accounts permission to use that key. The usual fix is a copy: copy the AMI to itself, specifying your own KMS key, then share the copy.",[25,682,683],{},"Two smaller behaviors worth knowing. You do not have to share the underlying snapshots separately, because EC2 grants launch access to them on your behalf. And your user-defined tags do not travel with a shared AMI, so the receiving account sees an untagged image.",[32,685,687],{"id":686},"retiring-an-image-three-verbs-that-are-not-synonyms","Retiring an image: three verbs that are not synonyms",[25,689,690],{},"An organization that builds a weekly golden AMI has 52 images a year, per Region, per OS. Cleaning them up is a real operational task, and AWS gives you three distinct actions that learners routinely blur together.",[100,692,693,708],{},[103,694,695],{},[106,696,697,699,702,705],{},[109,698],{},[109,700,701],{},"Deprecate",[109,703,704],{},"Disable",[109,706,707],{},"Deregister",[118,709,710,724,738,755,768,782,796],{},[106,711,712,715,718,721],{},[123,713,714],{},"Can new instances launch from it?",[123,716,717],{},"Yes, if the launcher knows the AMI ID",[123,719,720],{},"No, launches fail",[123,722,723],{},"No",[106,725,726,729,732,735],{},[123,727,728],{},"Auto Scaling groups and launch templates",[123,730,731],{},"Keep working",[123,733,734],{},"Keep referencing it, and their launches fail",[123,736,737],{},"Their launches fail",[106,739,740,743,746,752],{},[123,741,742],{},"Visible in listings",[123,744,745],{},"Hidden from users, visible to the owner",[123,747,748,749],{},"Hidden by default, visible only to the owner with ",[205,750,751],{},"--include-disabled",[123,753,754],{},"Gone",[106,756,757,760,763,766],{},[123,758,759],{},"Sharing",[123,761,762],{},"Unaffected",[123,764,765],{},"All launch permissions removed, AMI becomes private",[123,767,754],{},[106,769,770,773,776,779],{},[123,771,772],{},"Reversible",[123,774,775],{},"Yes, cancel the deprecation date",[123,777,778],{},"Yes, re-enable, but sharing is not restored",[123,780,781],{},"No, except from the Recycle Bin if a retention rule matched",[106,783,784,787,790,793],{},[123,785,786],{},"Snapshots still billed",[123,788,789],{},"Yes",[123,791,792],{},"Yes, and they cannot be deleted while the AMI is disabled",[123,794,795],{},"Only if you left them behind",[106,797,798,801,803,805],{},[123,799,800],{},"Running instances",[123,802,762],{},[123,804,762],{},[123,806,762],{},[25,808,809,810,812,813,815,816,818],{},"Read that table as an escalation ladder. ",[47,811,701],{}," is a signal: stop choosing this image, but nothing breaks. ",[47,814,704],{}," is a stop: launches fail, and you can undo it. ",[47,817,707],{}," is deletion.",[25,820,821],{},"The numbers AWS asks about directly: you can set a deprecation date up to 10 years out for a private AMI, public AMIs default to deprecation 2 years after creation, and the only way to move a public AMI's deprecation later is to make it private by sharing it with specific accounts.",[25,823,824,825,828,829,832],{},"Then there is the cost trap. Deregistering an AMI does ",[47,826,827],{},"not"," delete its backing snapshots by default. A team that deregisters 40 stale AMIs and expects the storage bill to drop is in for a surprise, because the snapshots are still there. Pass ",[205,830,831],{},"--delete-associated-snapshots"," on the deregister call, or clean them up afterwards. A snapshot referenced by more than one AMI is kept regardless.",[25,834,835,836,839,840,843],{},"You do not have to do any of this by hand. ",[47,837,838],{},"Image Builder lifecycle policies"," apply deprecate, disable, and delete actions to the images a pipeline produced, using age-based and count-based rules with exclusion rules to protect images you must keep. ",[47,841,842],{},"Amazon Data Lifecycle Manager"," covers the same ground for EBS-backed AMIs generally, including AMIs you did not build with Image Builder.",[32,845,847],{"id":846},"exam-tips","Exam tips",[40,849,850,865,868,871,874,877,880,883],{},[43,851,852,853,856,857,860,861,864],{},"\"Stop launches now, and let us undo it later\" is ",[47,854,855],{},"disable",". \"Mark as out of date but keep it working\" is ",[47,858,859],{},"deprecate",". \"Delete it\" is ",[47,862,863],{},"deregister",". Options that mix the effects are the distractors.",[43,866,867],{},"If a stem says an Auto Scaling group is still launching from an old image after the team deprecated it, that is the expected behavior, not a bug. Deprecation hides an AMI from listings; it never blocks a launch by ID.",[43,869,870],{},"Deregistering does not stop the snapshot bill on its own. Any answer that treats deregistration as a complete cleanup is wrong.",[43,872,873],{},"Encrypted AMI sharing needs a customer managed KMS key plus a grant to the target account. If the stem mentions the default AWS managed key, the sharing cannot work, and the answer involves copying with your own key.",[43,875,876],{},"An Image Builder pipeline that fails its tests distributes nothing. If a question asks why a new AMI never appeared in the DR Region, a failed test component is a prime suspect, alongside the Region simply not being in the distribution settings.",[43,878,879],{},"\"Build only when the base image is patched\" is the dependency-update schedule setting, and it depends on semantic versioning in the recipe.",[43,881,882],{},"Image Builder itself is free. Charges come from the build and test instances, snapshots, logs, Inspector, and ECR.",[43,884,885],{},"Watch for the bake-versus-bootstrap split in scenario stems. Long launch times point at baking; per-environment configuration points at bootstrapping.",[25,887,888],{},"The idea to carry forward is that an image is a build artifact with a version, a test suite, and an expiry, not a server someone once configured. That framing is what makes the whole domain coherent: the image is built from a file, tested before it ships, distributed by policy, and retired on schedule.",[25,890,891],{},"Everything in this lesson assumed the unit you ship is a machine. The next lesson swaps that assumption. When the machine already exists and only the application changes, you ship a container image instead, and almost every idea here reappears in a smaller and faster form.",[893,894,895],"style",{},"html pre.shiki code .sQzsp, html code.shiki .sQzsp{--shiki-light:#E53935;--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":331,"searchDepth":364,"depth":364,"links":897},[898,899,900,901,902,903,904,905,906],{"id":34,"depth":353,"text":35},{"id":83,"depth":353,"text":84},{"id":199,"depth":353,"text":200},{"id":217,"depth":353,"text":218},{"id":552,"depth":353,"text":553},{"id":617,"depth":353,"text":618},{"id":644,"depth":353,"text":645},{"id":686,"depth":353,"text":687},{"id":846,"depth":353,"text":847},"md",[909],{"slug":561,"concept":910,"style":911,"aspectRatio":912,"labels":913},"A left-to-right flow of one EC2 Image Builder pipeline run. Three configuration resources sit above the flow and drop into the stage they feed: the image recipe into the build stage, the infrastructure configuration into the build stage, and the distribution settings into the distribution step. The flow itself runs build stage, snapshot, test stage, then a decision fork where a failed test dead-ends and a passed test continues into distribution across Regions and accounts. The fork is the emphasis of the image: the test stage is a gate, not a report.","diagram","16:9",[914,915,916,917,918,919,920,921,922,923,924],"EC2 Image Builder pipeline","Image recipe: base image, build components, instance settings","Infrastructure configuration: instance type, subnet, security group, instance profile, logs","Distribution settings: target Regions, accounts and OUs, KMS key, launch template","Build stage: launch build instance, run build and validate phases","Snapshot","Test stage: launch a fresh instance from the snapshot, run test phases","Tests fail: build instance terminates, nothing is distributed","Tests pass: distribution runs","Output AMI in every target Region and account","The test stage is a gate, not a report: an image that fails its tests never reaches a Region.",[13,14,15,16,17,18],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/01-machine-and-container-images/01-amis-and-ec2-image-builder",{"passingScore":929,"questions":930},70,[931,940,950,958,966,974,982,991,999],{"question":932,"type":933,"options":934,"correctAnswer":937,"explanation":939},"An Auto Scaling group is still launching instances from an AMI that a security review just rejected. The team needs launches from that AMI to stop right now, and they want to be able to reverse the change if the rejection turns out to be a false positive. What should they do?","single",[935,936,937,938],"Deprecate the AMI","Deregister the AMI","Disable the AMI","Remove the AMI's launch permissions","Disabling puts the AMI into the disabled state so any launch that references it fails, and the AMI can be re-enabled later. Deprecating is the tempting wrong answer because it sounds final, but a deprecated AMI is only hidden from listings and Auto Scaling groups keep launching from it by ID. Deregistering would stop the launches too, but it is permanent.",{"question":941,"type":942,"options":943,"correctAnswers":948,"explanation":949},"Which statements about disabling an AMI are correct? (Choose 2.)","multiple",[944,945,946,947],"All launch permissions are removed and the AMI becomes private","Instances already running from the AMI are stopped","You stop paying for the AMI's EBS snapshots","The AMI can be re-enabled, but accounts it was shared with do not regain access automatically",[944,947],"Disabling strips sharing as a side effect, which is the part people miss: re-enabling brings the AMI back but you have to share it again. Running instances are untouched by any AMI lifecycle action, and the snapshots stay in place and stay billed because the AMI still exists.",{"question":951,"type":933,"options":952,"correctAnswer":953,"explanation":957},"By default, what deprecation date does a public AMI receive?",[953,954,955,956],"Two years from the AMI creation date","Ten years from the AMI creation date","No deprecation date is set by default","Ninety days after the AMI was last used to launch an instance","AWS sets a 2-year default deprecation date on public AMIs so stale public images fall out of listings on their own. Ten years is the upper limit you can set on a private AMI, not a default, and the only way to push a public AMI's deprecation later is to make it private by sharing it with specific accounts instead.",{"question":959,"type":933,"options":960,"correctAnswer":964,"explanation":965},"An EC2 Image Builder pipeline builds successfully, but a test component fails during the test stage. What happens?",[961,962,963,964],"The image is distributed with a warning recorded in the pipeline history","The image is distributed only to the Region where it was built","The pipeline retries the build stage automatically","The image is not distributed to any target","Distribution only runs when every configured test succeeds, which is what makes the test stage a gate rather than a report. That gate is the whole reason to define test components: a golden AMI that boots but fails its own health check should never reach a Region.",{"question":967,"type":933,"options":968,"correctAnswer":970,"explanation":973},"A pipeline is scheduled daily with the option to run only when dependency updates are available, but it rebuilds every single day even when nothing changed. What is the most likely cause?",[969,970,971,972],"The pipeline schedule uses UTC instead of the local time zone","The base image or the components are not pinned with semantic versioning","The infrastructure configuration terminates the build instance on failure","The distribution settings target more than one Region","Image Builder detects dependency updates by comparing semantic versions of the base image and the components, so recipes that do not use semantic versioning give it nothing to compare and every scheduled run becomes a full build. Time zones, failure handling, and distribution targets have no effect on whether a build is skipped.",{"question":975,"type":933,"options":976,"correctAnswer":979,"explanation":981},"An operations team deregisters 40 old AMIs to reduce their EBS bill, and the bill barely moves. Why?",[977,978,979,980],"Deregistered AMIs move to the Recycle Bin and keep billing until the retention period expires","AMI deregistration is asynchronous and takes up to 30 days to take effect","Deregistering an AMI does not delete its backing snapshots unless you ask for that explicitly","Snapshot storage is billed to the account that launched instances from the AMI","The AMI is a pointer plus metadata; the storage cost lives in the snapshots behind it, and those survive deregistration unless you pass the delete-associated-snapshots option or clean them up afterwards. A snapshot shared by more than one AMI is kept even when you do ask for deletion.",{"question":983,"type":942,"options":984,"correctAnswers":989,"explanation":990},"You need to share an AMI backed by encrypted snapshots with another AWS account. Which two conditions must be met? (Choose 2.)",[985,986,987,988],"The snapshots must be encrypted with a customer managed KMS key, not the default AWS managed key","The snapshots must be shared explicitly in addition to the AMI","The target account must be granted permission to use the KMS key","The AMI's user-defined tags must be copied to the target account first",[985,987],"An AMI encrypted with the default AWS managed key can never be shared, because that key policy cannot be edited, so the fix is always to re-encrypt with a customer managed key during a copy. Sharing the snapshots separately is not required since EC2 grants launch access to them, and user-defined tags simply do not travel with a shared AMI.",{"question":992,"type":933,"options":993,"correctAnswer":995,"explanation":998},"A deployment takes 9 minutes because every new instance patches the OS and installs three agents from user data at launch. The team wants scale-out to complete in under 2 minutes while still allowing a per-environment database endpoint to be set at boot. What should they do?",[994,995,996,997],"Move everything, including the database endpoint, into a golden AMI built by a pipeline","Bake the patches and agents into a golden AMI, and keep the endpoint in user data","Keep user data as is and increase the Auto Scaling group's health check grace period","Replace user data with a Systems Manager State Manager association that runs after launch","Baking moves the slow and stable work to build time, where the wait costs nothing, and bootstrapping keeps the per-environment values out of the image so one AMI serves every environment. Baking the endpoint too would force a separate image per environment, and a longer grace period hides the delay instead of removing it.",{"question":1000,"type":933,"options":1001,"correctAnswer":1003,"explanation":1004},"True or False: an AMI created in eu-west-1 can be used to launch an instance in eu-west-2 by referencing its AMI ID.",[1002,1003],"True","False","An AMI is a Regional resource, and an AMI ID has no meaning outside the Region that holds it. To launch in a second Region you copy the AMI there and get a new AMI ID, which is exactly what Image Builder distribution settings automate for every target Region on every build.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/01-machine-and-container-images/01-amis-and-ec2-image-builder","oLoaIhpUCXgDLIiKivoCn8G9shg_6f-BcZB1K2vRpDw",{"locked":9,"reason":1009,"meta":1010,"item":3},"paywall",{"title":1011,"description":1012,"isFree":5,"estimatedMinutes":1013,"difficulty":1014,"learningObjectives":1015},"Disaster Recovery Strategies","RTO and RPO as the numbers that pick the architecture, the four AWS disaster recovery strategies from backup and restore to multi-site active/active, the data plane rule that decides how you fail over, and why every strategy still needs backups.",28,"advanced",[1016,1017,1018,1019,1020,1021],"Define RTO and RPO precisely and use them to select a disaster recovery strategy","Compare backup and restore, pilot light, warm standby, and multi-site active/active by cost, complexity, RTO, and RPO","Explain the difference between pilot light and warm standby in terms of what must happen before traffic can be served","Apply the data plane over control plane rule when designing a failover mechanism","Select the right cross-Region data replication service for a given database or storage layer","Explain why a multi-site active/active architecture still requires point-in-time backups",{"locked":9,"reason":1009,"meta":1023,"item":3},{"title":1024,"description":1025,"isFree":5,"estimatedMinutes":1026,"difficulty":11,"learningObjectives":1027},"Container Images and Amazon ECR","How container images are layered and addressed by digest, how ECR authentication and its three permission layers work, and how tag immutability, basic and enhanced scanning, lifecycle policies, replication, and pull through cache keep a registry usable in production.",25,[1028,1029,1030,1031,1032,1033],"Explain how container image layers, manifests, tags, and digests relate to each other","Authenticate Docker to an ECR private registry and describe how long the credential lasts","Distinguish IAM identity policies, repository policies, and registry policies in ECR","Compare ECR basic scanning with enhanced scanning and pick the right one for a requirement","Write an ECR lifecycle policy and predict which images it will expire","Choose between registry replication and a pull through cache rule for a given goal"]