A company uses AWS Organizations to manage its AWS environment. The company implements a process that uses prebuilt Amazon Machine Images (AMIs) to launch instances as a security measure. All AMIs are

Question

Options

• AImplement a tag policy for the company's organization to require users to set the ApprovedAMI
• BImplement an IAM policy that includes an aws:ResourceTag/ApprovedAMI condition.
• CSet up an AWS Config required-tags rule to prevent users from launching any nonapproved AMIs.
• DUse Amazon GuardDuty to constantly monitor DefenseEvasion:EC2/UnusualDoHActivity findings.

• A
  3% (1)
• B
  85% (28)
• C
  9% (3)
• D
  3% (1)

Explanation

To ensure users can launch instances only from approved AMIs, the control must be enforced at authorization time, not after the fact. An IAM policy with a condition that evaluates the resource tags on the AMI is the correct method. By using an aws:ResourceTag/ApprovedAMI condition (paired with allowing ec2:RunInstances only when the chosen AMI has the required tag/value), the organization can prevent launches from untagged or unapproved images. This implements preventative control and aligns with least privilege.

No community discussion yet for this question.