Question

A CloudOps engineer manages a centralized 'shared services' AWS account that builds a hardened, monthly golden AMI using an SSM Automation runbook. The organization has 40 workload accounts that must be able to launch EC2 instances from the newest golden AMI. The AMI is currently only available in the shared services account, and each workload team must manually copy the AMI ID. The engineer needs an automated, repeatable way to make the latest AMI ID discoverable across all workload accounts without granting broad AMI-sharing permissions each cycle. Which approach best meets these requirements?

Accepted Answer

After building the AMI, have the Automation runbook share the AMI with the AWS Organization and write the AMI ID to an SSM Parameter Store parameter that is shared across the organization via AWS Resource Access Manager (RAM).

Answer

Have the Automation runbook share the AMI with each account ID and write the AMI ID to a Parameter Store SecureString parameter in the shared services account, then have workload accounts read it directly.

Answer

Configure a CloudFormation StackSet that copies the AMI into all 40 accounts on a schedule and stores the AMI ID as a stack output in each account.

Answer

Enable AMI sharing to all accounts and require workload teams to use an EventBridge rule to detect the new AMI and manually update their launch templates.