Question

A CloudOps engineer manages a CloudFormation template used to launch EC2 instances across multiple AWS Regions. Each Region has a different latest hardened AMI ID that a separate golden-AMI pipeline updates weekly. The engineer wants the template to always reference the current AMI for whichever Region it is deployed in, without hardcoding AMI IDs or editing the template each week. Which approach meets this requirement with the least ongoing effort?

Accepted Answer

Store each Region's latest AMI ID in an SSM Parameter Store parameter using a consistent name, and reference it in the template with an AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> parameter type.

Answer

Add a Mappings section listing every Region's AMI ID and update the mapping manually after each pipeline run.

Answer

Use a CloudFormation custom resource backed by a Lambda function that queries EC2 DescribeImages at every stack operation to find the newest AMI.

Answer

Export the AMI ID as a cross-stack output from a shared stack in one Region and import it in every other Region's stack.