Question

A DevOps team maintains a single CloudFormation template used to deploy an application across us-east-1, eu-west-1, and ap-southeast-2. The template launches EC2 instances that must use a region-specific, hardened AMI ID owned by the security team. The AMI IDs are updated roughly once per quarter through a separate golden-AMI pipeline. Deployments are triggered via a CodePipeline that runs the same template in all three regions. The team wants the correct AMI to be selected automatically per region at deploy time, without editing the template body and without manually passing AMI IDs as parameters on each run. Which approach best meets these requirements?

Accepted Answer

Store each region's latest hardened AMI ID in a Systems Manager Parameter Store parameter (same name per region) and reference it in the template using an SSM parameter type (AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>) so each stack resolves the value at deploy time.

Answer

Define a CloudFormation Mappings section that hardcodes the AMI ID for each region and use Fn::FindInMap with AWS::Region to select the value.

Answer

Pass the AMI ID as a CloudFormation parameter and have the CodePipeline deploy action supply the value from a variable configured per region in the pipeline.

Answer

Use a Lambda-backed custom resource that calls the EC2 DescribeImages API during every stack update to look up the newest AMI matching a name filter.