Study guide
3.2 Automated Image Baking with EC2 Image Builder
AWS Certified DevOps Engineer – Professional Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CI/CD Pipeline Architecture & Source Integration
1.1 Multi-Stage & Multi-Account CodePipeline Design 1.2 CodeBuild Projects, Build Environments & Pipeline Secrets 1.3 Source Control Workflows, Webhooks & Branching Models
2 Chapter 2: Automated Testing, Test Gates & Quality Verification
2.1 Automated Unit, Integration & Acceptance Testing in Pipelines 2.2 Load Testing, Performance Benchmarking & Synthetic Canaries 2.3 Security Scanning, SAST/DAST & Approval Gates
3 Chapter 3: Artifact Management & Multi-Platform Deployment Strategies
3.1 Artifact Lifecycle Management with CodeArtifact, ECR & S3 3.2 Automated Image Baking with EC2 Image Builder 3.3 In-Place, Rolling & Immutable Deployments on EC2 3.4 Blue/Green & Canary Deployments for ECS, EKS & Lambda
4 Chapter 4: CloudFormation, CDK & Reusable IaC Components
4.1 Advanced CloudFormation: Nested Stacks, Change Sets & Custom Resources 4.2 Cross-Account & Multi-Region StackSets & Drift Detection 4.3 Modern IaC: AWS CDK, SAM & Service Catalog Governance
5 Chapter 5: Multi-Account Architecture, Organizations & Control Tower
5.1 AWS Organizations Hierarchy, OUs & Account Provisioning 5.2 Service Control Policies (SCPs) & Multi-Account Guardrails 5.3 AWS Control Tower, Account Factory & Landing Zone Automation
6 Chapter 6: Systems Manager & Large-Scale Fleet Configuration
6.1 SSM Agent, Hybrid Activation & Session Manager 6.2 Systems Manager Run Command, State Manager & Associations 6.3 Patch Manager, Parameter Store vs Secrets Manager & AppConfig
7 Chapter 7: High Availability & Multi-Region Resiliency
7.1 Designing Resilient Multi-AZ & Multi-Region Architectures 7.2 Route 53 Traffic Flow, Health Checks & DNS Failover 7.3 Data Replication: Aurora Global DB, DynamoDB Global Tables & S3 CRR
8 Chapter 8: Scalability, Auto Scaling & Disaster Recovery Automation
8.1 EC2 Auto Scaling Policies, Lifecycle Hooks & Warm Pools 8.2 Container & Serverless Scalability: ECS Capacity Providers, EKS & API Gateway 8.3 Disaster Recovery Strategies: RTO, RPO & Architecture Tiers 8.4 Automated Backup & Recovery with AWS Backup & Elastic Disaster Recovery
9 Chapter 9: CloudWatch Metrics, Agent Collection & Log Aggregation
9.1 CloudWatch Metrics, Dimensions, Metric Math & High Resolution 9.2 Unified CloudWatch Agent & Custom Metric Collection 9.3 Centralized Log Aggregation, Retention & Cross-Account Subscriptions
10 Chapter 10: Log Analysis, Dashboards & Distributed Tracing with X-Ray
10.1 CloudWatch Logs Insights, Filter Syntax & Query Optimization 10.2 CloudWatch Dashboards, Composite Alarms & Anomaly Detection 10.3 Distributed Tracing with AWS X-Ray & Service Maps
11 Chapter 11: Automated Observability & Event-Driven Monitoring
11.1 Application & Infrastructure Health Checks with Route 53 & ALB 11.2 Centralized Observability with Amazon OpenSearch & Athena 11.3 Synthetic Monitoring with CloudWatch Synthetics Canaries
12 Chapter 12: Event-Driven Incident Detection & Notification Pipelines
12.1 AWS Health, CloudTrail Events & Operational Notification 12.2 EventBridge Event Routing, Patterns & Multi-Account Buses 12.3 Asynchronous Event Processing: SNS, SQS Queues & Dead-Letter Handling
13 Chapter 13: Automated Remediation & Deployment Troubleshooting
13.1 AWS Config Managed Rules & Automated Remediation with SSM 13.2 Event-Driven Infrastructure Self-Healing with Lambda & Step Functions 13.3 Troubleshooting CI/CD Pipeline & Deployment Failures 13.4 Root Cause Analysis for Auto Scaling & Container Failures
14 Chapter 14: Identity, Access Management & Secrets at Scale
14.1 IAM Policy Evaluation Logic, NotAction & Explicit Denies 14.2 IAM Permissions Boundaries & Delegated Administration 14.3 IAM Identity Center, Cross-Account Roles & STS Session Policies 14.4 Automated Secrets Management & Secret Rotation with Secrets Manager
15 Chapter 15: Security Automation, Data Protection & Compliance Auditing
15.1 Network Security Automation: Security Groups, NACLs, Network Firewall & WAF 15.2 Cryptographic Controls & Key Management with AWS KMS & ACM 15.3 Automated Threat Detection: GuardDuty, Inspector & Security Hub 15.4 Continuous Compliance Auditing & Log Integrity with CloudTrail & Config
3.2 Automated Image Baking with EC2 Image Builder
Key Takeaways Explain This Topic AI
EC2 Image Builder automates Golden AMI and container image generation using four core constructs: Image Recipes, Infrastructure Configurations, Distribution Settings, and Image Pipelines.
Build and test components use declarative YAML documents specifying step-by-step actions executed sequentially across distinct build, validate, and test phases.
Infrastructure configurations define the ephemeral build instance environment, requiring the EC2InstanceProfileForImageBuilder IAM role and secure VPC networking with Systems Manager endpoints for isolated builds.
Distribution configurations automate multi-region copying, cross-account launch permission sharing via AWS Organizations, and KMS key re-encryption using destination CMKs.
Golden AMI pipelines incorporate Center for Internet Security (CIS) Benchmark components and integrate with Amazon Inspector to conduct automated vulnerability assessments prior to image distribution.
Last updated: September 2026
Automated Image Baking Architecture
In high-velocity enterprise environments, deploying virtual machine workloads requires a balance between boot-time configuration (bootstrapping via user-data) and pre-baked configuration (Golden AMIs). While bootstrapping introduces runtime latency and vulnerability to external repository failures, traditional manual AMI creation produces configuration drift and undocumented dependencies.
AWS EC2 Image Builder provides a fully managed, serverless orchestration pipeline to automate the creation, management, testing, and distribution of secure, compliant Amazon Machine Images (AMIs) and Open Container Initiative (OCI) container images.
The Four Core Constructs of EC2 Image Builder +-----------------------------------------------------------------------------+
- | EC2 Image Builder Pipeline |
- | |
- | +---------------------+ +---------------------------------------+ |
- | | Image Recipe | | Infrastructure Configuration | |
- | | - Base AMI | | - IAM: EC2InstanceProfileForImage... | |
- | | - Build Components | | - Subnet, Security Groups, VPC | |
- | | - Test Components | | - Instance Type (e.g., m5.large) | |
- | | - Storage (EBS) | | - Terminate Instance on Failure | |
- | +----------+----------+ +-------------------+-------------------+ |
- | | | |
- | +-------------------+--------------------+ |
- | | |
- | v |
- | +-----------------------------------+ |
- | | Image Build & Validation Flow | |
- | | 1. Launch temporary EC2 instance| |
- | | 2. Execute Build components | |
- | | 3. Create snapshot & AMI | |
- | | 4. Launch Test instance & test | |
- | | 5. Terminate build instances | |
- | +-----------------+-----------------+ |
- | | |
- | v |
- | +------------------------------+ |
- | | Distribution Settings | |
- | | - Multi-Region AMI Copy | |
- | | - Cross-Account Permissions | |
- | | - Destination KMS Re-encrypt | |
- | | - SSM Parameter / Launch Tmpl| |
- | +------------------------------+ |
- +-----------------------------------------------------------------------------+
Image Recipe : The blueprint defining the source parent image (e.g., Amazon Linux 2023, Red Hat Enterprise Linux, Ubuntu, or Windows Server), additional EBS storage volume configurations, working directories, and the ordered sequence of Build Components and Test Components .
Infrastructure Configuration : Defines the ephemeral compute environment launched to execute the recipe. Specifies the build instance type (e.g., t3.medium , m5.large ), the VPC subnet, security groups, key pair (optional), SNS alert topics, S3 logging bucket, and the critical IAM Instance Profile ( EC2InstanceProfileForImageBuilder ).
Distribution Configuration : Governs the output distribution rules after testing passes. Configures target AWS regions, cross-account sharing (via AWS Account IDs or AWS Organization / Organizational Unit ARNs), AMI launch permissions, target KMS CMK encryption keys per region, and automatic updates to Amazon EC2 Launch Templates or AWS Systems Manager Parameter Store parameters.
Image Pipeline : The automation engine that binds the Recipe, Infrastructure Configuration, and Distribution Configuration together. Governs trigger conditions, such as cron schedules, rate expressions, manual execution, or Amazon EventBridge events triggered when a new upstream parent AMI is released.
Component Document Authoring (YAML Specification)
Components are declarative documents written in YAML format using the Image Builder Component Document Schema Version 1.0 . Image Builder connects to the ephemeral build and test instances through the AWS Systems Manager Agent , installs the AWS Task Orchestrator and Executor (AWSTOE) application on each instance (or inside the running container for container recipes), and AWSTOE executes the component phases and steps sequentially.
Lifecycle Phases of a Component
build : Instructions executed to install software, apply kernel configurations, configure logging daemons, and set security baselines.
validate : Commands executed immediately after the build phase to confirm that services are running, binaries exist, and files are configured properly before creating the intermediate AMI snapshot.
test : Commands executed on a fresh instance launched from the newly baked AMI to verify bootability, application functionality, and end-to-end operational health.
Component Document Syntax Example
The following custom component document installs the CloudWatch agent, configures corporate hardening, and validates configuration syntax: name: EnterpriseHardeningAndCloudWatch
- description: Installs Unified CloudWatch Agent and configures CIS baseline
- schemaVersion: 1.0
phases:
- name: build
steps:
- name: InstallCloudWatchAgent
- action: ExecuteBash
inputs:
commands:
- echo "Downloading Amazon CloudWatch Agent..."
- wget -q https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm
- rpm -U ./amazon-cloudwatch-agent.rpm
- rm -f ./amazon-cloudwatch-agent.rpm
- name: ConfigureSecurityKernelParameters
- action: ExecuteBash
inputs:
commands:
- sysctl -w net.ipv4.ip_forward=0
- sysctl -w net.ipv4.conf.all.accept_redirects=0
- echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.d/99-cis.conf
- echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.d/99-cis.conf
- name: validate
steps:
- name: ValidateAgentInstallation
- action: ExecuteBash
inputs:
commands:
- /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status
- test -f /etc/sysctl.d/99-cis.conf
- name: test
steps:
- name: ExecuteHealthCheck
- action: ExecuteBash
inputs:
commands:
- echo "Running post-AMI boot validation..."
- systemctl is-enabled amazon-cloudwatch-agent
Common built-in actions include ExecuteBash , ExecutePowerShell , ExecuteBinary , S3Download , S3Upload , and SetRegistryKey .
Container Image Recipes & Output to Amazon ECR
In addition to virtual machine AMIs, EC2 Image Builder supports Container Image Recipes to bake Docker and OCI-compliant container images:
Base Image Source : Can be sourced from Amazon ECR Public, private Amazon ECR repositories, or Docker Hub.
Dockerfile or Components : You can supply inline Dockerfile directives or attach modular Image Builder components that execute container build commands.
Testing Phase : Image Builder launches the container inside an isolated environment, runs container health probes and test scripts.
Target Distribution : Upon passing validation, the pipeline automatically signs, tags, and pushes the final container image directly to target Amazon ECR repositories across multiple AWS accounts and regions.
CIS Benchmark Hardening & Amazon Inspector Integration
Enterprise security compliance mandates strict alignment with Center for Internet Security (CIS) Benchmarks (Level 1 and Level 2 profiles).
AWS-Managed Compliance Components : AWS provides pre-built, versioned CIS benchmark components directly inside Image Builder for Amazon Linux 2, Amazon Linux 2023, RHEL, and Windows Server.
Amazon Inspector Integration : EC2 Image Builder integrates natively with Amazon Inspector to conduct automated Common Vulnerabilities and Exposures (CVE) scanning during the image build pipeline. If Inspector detects high or critical vulnerabilities exceeding corporate risk thresholds, Image Builder fails the pipeline execution, preventing vulnerable AMIs from being published.
Multi-Account Golden AMI Distribution Architecture
A critical DevOps professional pattern involves distributing AMIs across hundreds of spoke AWS accounts within an Organization.
Cross-Account AMI Sharing and KMS Key Permissions
When sharing an AMI encrypted with an AWS KMS Customer Managed Key (CMK) across AWS accounts, direct sharing requires two coordinated permission layers:
AMI Launch Permission : In the distribution configuration, share the AMI with the target AWS Account IDs or Organization path ( arn:aws:organizations::123456789012:organization/o-abc123def ).
KMS Key Policy Permission : The KMS CMK used to encrypt the underlying EBS snapshot in the build account must explicitly grant access to the target account's root principal or roles via kms:DescribeKey , kms:ReEncrypt* , kms:CreateGrant , and kms:Decrypt .
Exam Trap : AWS-managed KMS keys ( aws/ebs ) cannot be shared across accounts . You MUST use a Customer Managed Key (CMK) to encrypt the Golden AMI snapshots if the image is distributed to external AWS accounts. {
- "Sid": "AllowSpokeAccountsToDecryptGoldenAMI",
- "Effect": "Allow",
- "Principal": {
- "AWS": "arn:aws:iam::222233334444:root"
- },
- "Action": [
- "kms:DescribeKey",
- "kms:ReEncrypt*",
- "kms:CreateGrant",
- "kms:Decrypt"
- ],
- "Resource": "*"
- }
Once shared, target accounts typically copy the shared AMI into their local region and re-encrypt the snapshot using their own local KMS CMK, isolating encryption boundaries.
Image Baking Strategies: Bake vs. Fry vs. Half-Baked
- Attribute Golden AMI (Bake) Bootstrap User-Data (Fry) Hybrid (Half-Baked)
- Boot Time Latency Extremely Fast (< 60 seconds) Slow (5–15+ minutes) Fast (1–3 minutes)
- Drift Risk Zero drift during launch High (external packages may change) Low
- Build Pipeline Time Longer build time (30–60 mins) Instant (no pre-build needed) Moderate (15–20 mins)
- External Dependency Risk Immune to external repo outages Highly vulnerable to mirror outages Low vulnerability
Maintenance Cadence Pipeline runs on patch schedules Scripts updated in launch templates Base baked monthly, apps pulled at launch
Ideal Use Case Large Auto Scaling fleets needing rapid scale-out Ad-hoc dev environments, ephemeral testing Enterprise standard: OS/agents pre-baked, latest code fetched