8.1 Golden Images with EC2 Image Builder & Amazon ECR

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

8.1 Golden Images with EC2 Image Builder & Amazon ECR

Key Takeaways Explain This Topic AI

EC2 Image Builder automates the building, testing, and distribution of hardened golden AMIs and container images across AWS accounts and Regions.

Image recipes define base OS images, build components (for software and CIS/STIG hardening), and test components, while infrastructure configurations specify worker instance types, VPC subnets, and IAM roles.

Distribution configurations govern cross-account sharing (via AWS Organizations or account IDs), multi-Region replication, and mandatory AWS KMS re-encryption using target Customer Managed Keys (CMKs).

Amazon ECR tag immutability prevents image tag tampering or accidental overwrites, while ECR lifecycle policies automatically purge untagged images or retain the last N tagged images to optimize storage costs.

ECR offers basic vulnerability scanning (Clair, scan-on-push) and enhanced scanning (Amazon Inspector, continuous CVE vulnerability detection across repositories and running container workloads).

Last updated: September 2026

8.1 Golden Images with EC2 Image Builder & Amazon ECR

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to automate golden image creation, enforce security baselines with EC2 Image Builder, manage cross-account and cross-Region AMI distribution, secure container registries with Amazon ECR tag immutability and lifecycle policies, and detect vulnerabilities using basic and enhanced Amazon Inspector scanning.

EC2 Image Builder Architecture & Pipelines

Modern cloud operations mandate immutable infrastructure patterns where machine images (AMIs) and container images are standardized, hardened, and tested before deployment. AWS EC2 Image Builder provides an automated pipeline service to produce and validate golden AMIs and container images without custom maintenance scripts.

An Image Builder pipeline orchestrates three core resources:

Image Recipe (or Container Recipe): Combines a base operating system image with build and test components.

Infrastructure Configuration: Defines compute capacity, VPC networking, and IAM permissions used to run the build.

Distribution Configuration: Defines target AWS accounts, AWS Organizations Organizational Units (OUs), and AWS Regions receiving the final image.

Recipe Components: Build and Test Phases

An Image Recipe pairs a parent image (e.g., Amazon Linux 2023 or Windows Server) with declarative YAML Components across three sequential phases:

Build Phase: Installs software, CloudWatch and Systems Manager agents, and executes CIS benchmarks or DISA STIG hardening scripts.

Validate Phase: Verifies software installations and service states.

Test Phase: Executes automated smoke and security tests (e.g., InSpec, OpenSCAP).

If any test step returns a non-zero exit code, Image Builder aborts the pipeline, marks the build as failed, and terminates the worker instance, preventing defective images from publishing.

Infrastructure Configuration & Build Environment

The Infrastructure Configuration dictates the temporary EC2 worker environment:

Compute & Networking: Defines instance type (e.g., t3.medium ), VPC subnet, and security group. In private subnets, VPC endpoints for Systems Manager ( ssm , ssmmessages , ec2messages ) and S3 are mandatory, as Image Builder orchestrates builds via Systems Manager Run Command.

IAM Instance Profile: Attaches an IAM role containing EC2InstanceProfileForImageBuilder and AmazonSSMManagedInstanceCore .

S3 Logging: Directs component logs and console outputs to an S3 bucket for auditing.

Distribution Configuration & KMS Re-Encryption

The Distribution Configuration defines multi-account and multi-Region distribution:

Target Regions: Replicates finalized AMIs to destination Regions, assigning regional AMI IDs while preserving metadata and tags.

Launch Permissions: Grants specific AWS account IDs or an entire AWS Organizations OU rights to launch instances from the distributed AMI.

KMS Key Re-Encryption: Encrypts EBS snapshots in target accounts and Regions.

Parameter Operational Function KMS & Security Requirements

Launch Permissions Shares AMI across AWS accounts or Organizations OUs. Allows member accounts to launch EC2 instances directly.

Regional Replication Copies golden AMI to target destination Regions. Requires regional KMS CMKs in each destination Region.

KMS Encryption Key Re-encrypts snapshots during cross-account/Region copy. AWS-managed keys ( aws/ebs ) cannot be shared cross-account. Must specify destination CMK ARNs.

Important

EBS snapshots encrypted with default AWS-managed KMS keys ( aws/ebs ) cannot be shared cross-account . To distribute encrypted AMIs to member accounts, the distribution configuration must specify destination KMS Customer Managed Keys (CMKs), and destination key policies must permit Image Builder to create grants and re-encrypt snapshots.

Image Pipeline Execution Triggers

Image Pipelines support three execution trigger patterns:

Manual Execution: Triggered on demand via the console, AWS CLI ( aws imagebuilder start-image-pipeline-execution ), or CI/CD pipelines.

Schedule Expressions: Automated recurring builds defined via cron or rate expressions (e.g., weekly builds for OS security patches).

Event-Driven Triggers via Amazon EventBridge: Executes automatically when upstream base AMIs are updated by AWS or when vulnerability alerts trigger remediation workflows.

Amazon Elastic Container Registry (ECR) Governance

Amazon ECR provides a managed OCI container registry requiring strict operational governance.

Tag Immutability

By default, ECR allows tag mutability, allowing tags like latest or v1.2.0 to be overwritten. Enabling Tag Immutability guarantees that pushed tags cannot be altered, rejecting duplicate tags with ImageTagAlreadyExistsException .

ECR Lifecycle Policies

To prevent unbounded storage costs, ECR Lifecycle Policies evaluate declarative JSON rules in priority order:

Untagged Images: Purges intermediate or untagged images after a set retention window (e.g., 7 days).

Tagged Image Count: Retains only the last N N N images matching a prefix (e.g., retaining the 20 most recent prod-* images).

Tagged Image Age: Expires non-production images (e.g., test-* ) older than 30 days.

ECR Image Vulnerability Scanning: Basic vs. Enhanced

Amazon ECR offers two vulnerability scanning tiers to secure container images:

Feature Basic Scanning Enhanced Scanning (Amazon Inspector)

Engine Open-source Clair engine. Amazon Inspector vulnerability engine.

Frequency Manual on-demand or Scan-on-Push . Continuous Scanning on push and ongoing CVE monitoring.

Package Scope Operating system packages only. Operating system packages and application language dependencies.

Runtime Context Static repository findings only. Correlates findings with running tasks in Amazon ECS and EKS.

Enhanced scanning eliminates the blind spot where an image passes scan-on-push inspection but becomes vulnerable later when a new CVE is published.

Cross-Account & Cross-Region ECR Replication

Amazon ECR supports native replication for enterprise architectures:

Cross-Region Replication: Replicates pushed images to secondary operating Regions, eliminating cross-Region pull latencies and data transfer costs.

Cross-Account Replication: Synchronizes golden container images from a central build account to member production accounts across AWS Organizations using repository prefix filters (e.g., prod/* ).