Question

A financial services company runs a large AWS Organization with 200+ accounts managed via AWS Control Tower. The security team has discovered that development teams occasionally launch EC2 instances from unvetted, publicly shared Amazon Machine Images (AMIs), introducing software supply chain risk. Leadership requires a solution that PREVENTS the launch of any instance from an AMI unless the AMI is owned by a designated internal 'golden image' account. The control must be enforced organization-wide and cannot be bypassed by account administrators, including those with full EC2 permissions. Which approach meets these requirements?

Accepted Answer

Attach a service control policy (SCP) to the organization root that denies ec2:RunInstances unless the ec2:Owner condition key matches the approved golden image account ID.

Answer

Deploy an AWS Config conformance pack with a managed rule that flags instances launched from unapproved AMIs and triggers automatic remediation to terminate them.

Answer

Enable a Security Hub control that continuously evaluates running instances against a list of approved AMI IDs and generates critical findings for violations.

Answer

Create a Control Tower detective guardrail that monitors AMI usage across accounts and notifies the security team when an unapproved AMI is used.