Question

A financial services company runs workloads across 40 AWS accounts in an organization. The security team maintains a list of approved (hardened) AMI IDs. They want to continuously detect any EC2 instance launched from a non-approved AMI across all accounts, record the compliance state centrally for audits, AND prevent developers from launching non-approved AMIs in the first place. Which combination of controls best satisfies both the detective and preventive requirements with the least custom code?

Accepted Answer

Deploy an AWS Config organization managed rule (approved-amis-by-id) via a conformance pack, aggregate results in a delegated administrator account, and attach a Service Control Policy (SCP) that denies ec2:RunInstances unless the ec2:ImageID condition key matches an approved AMI list.

Answer

Enable GuardDuty across the organization to detect non-approved AMI launches and use a permissions boundary on all developer IAM roles to block ec2:RunInstances for unapproved images.

Answer

Create a Lambda function subscribed to CloudTrail RunInstances events in each account that terminates instances launched from non-approved AMIs, and store findings in a central DynamoDB table for auditing.

Answer

Use Security Hub custom controls to flag non-approved AMIs and rely on an IAM identity-based policy in each account to deny launching unapproved AMIs.