- Ensure that your web-tier Auto Scaling Group (ASG) launch configurations are using approved (golden) Amazon Machine Images (AMIs) to launch EC2 instances within the ASG. An approved AMI is a base EC2 image that contains a pre-configured OS and a well-defined stack of server software fully configured to run your web applications. A list of approved AWS AMIs must be maintained by your organization. This conformity rule assumes that all AWS resources provisioned for your web tier are tagged with <web_tier_tag>:<web_tier_tag_value>, where <web_tier_tag> represents the tag name and <web_tier_tag_value> represents the tag value. Prior to running this rule by the Cloud Conformity engine, the web-tier tags and the IDs of the approved/golden AMIs maintained by your organization must be configured in the rule settings, on your Cloud Conformity account dashboard.
Using golden Amazon Machine Images to create new EC2 instances within your web-tier Auto Scaling Groups provides security and organizational benefits such as fast application deployment and scaling, secure application stack upgrades and versioning. Ensure that your web-tier ASG launch configuration template defines a golden AMI so that all EC2 instances launched within the ASG enforce consistency and follows best practices.
Note: Make sure that you replace all <web_tier_tag>:<web_tier_tag_value> tag placeholders found in the conformity rule content with your own tag name and value created for the web tier.
To determine if your web-tier ASG are using launch configurations with approved AMIs, perform the following actions:
Remediation / Resolution
To launch EC2 instances within your web-tier ASG from golden/approved Amazon Machine Images, you must re-create the web-tier ASG launch configuration template with a reference to a well-defined AMI maintained and approved by your organization. If there are no golden AMIs already available within your AWS account, follow the instructions outlined in this conformity rule to create the necessary AMIs. To set up a new ASG launch configuration, perform the following actions:
- AWS Documentation
- Auto Scaling Groups
- Launch Configurations
- Creating a Launch Configuration
- CIS Amazon Web Services Foundations
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
Get started for FREE
You are auditing:
Use Approved AMIs for Web-Tier ASG Launch Configurations
Risk level: High