Question

A DevOps team must standardize how EC2 AMIs are built and distributed across a 12-account AWS Organization. The requirement is a repeatable, auditable process that builds a hardened base image, applies OS patches, runs validation tests, and then distributes the finished AMI to member accounts—all defined as code and triggered on a schedule. The team wants to minimize custom scripting and maintenance of build orchestration infrastructure. Which approach best meets these requirements?

Accepted Answer

Use EC2 Image Builder with an image pipeline that references a recipe (base image plus hardening and patching components), a test/validation stage, and a distribution configuration that shares/copies the AMI to the member accounts, scheduled with a pipeline cron expression.

Answer

Write a CodeBuild project that launches an EC2 instance via the AWS CLI, runs shell scripts to patch and harden it, creates an AMI, and uses modifyImageAttribute calls to share it, triggered by an EventBridge scheduled rule.

Answer

Create an SSM State Manager association that installs patches on a long-running builder instance nightly, then use a Lambda function to snapshot the instance and register a new AMI for each account.

Answer

Deploy a CloudFormation StackSet that launches a builder EC2 instance in each member account and runs user-data scripts to patch and harden the OS locally in every account.