A company maintains a list of 75 approved Amazon Machine Images (AMIs) that can be used across an organization in AWS Organizations. The company's development team has been launching Amazon EC2…

Question

Options

• AAdd a tag to the approved AMIs. Create an IAM policy that includes a tag condition that allows
• BCreate a service-linked role. Attach a policy that denies the ability to launch EC2 instances from a
• CUse AWS Config with an AWS Lambda function to check for EC2 instances that are launched
• DUse AWS Trusted Advisor to check for EC2 instances that are launched from unapproved AMIs.

• A
  83% (45)
• B
  2% (1)
• C
  11% (6)
• D
  4% (2)

Explanation

The requirement is preventative: stop users from launching from unapproved AMIs. The most scalable approach with 75 approved AMIs is to tag all approved AMIs (for example, ApprovedAMI=true) and enforce usage through an IAM policy condition that only allows ec2:RunInstances when the ec2:ImageId resource (the AMI) includes the required tag. This avoids maintaining long allow/deny lists of AMI IDs and supports continuous updates: as new approved AMIs are created, tagging them automatically brings them under the policy without policy rewrites.

No community discussion yet for this question.