# EC2 Approved AMIs Check (by AMI Tag)

- Source: https://support.icompaas.com/support/solutions/articles/62000228167-ec2-approved-amis-check-by-ami-tag-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [IAM Policy](https://support.icompaas.com/support/solutions/folders/62000055680)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

An Amazon Machine Image (AMI) provides the information required to launch an instance. You must specify an AMI when you launch an instance. You can launch multiple instances from a single AMI when you need multiple instances with the same configuration. You can use different AMIs to launch instances when you need instances with different configurations.

You can select an AMI to use based on the following characteristics:

-   Region (see Regions and Zones)
    
-   Operating system
    
-   Architecture (32-bit or 64-bit)
    
-   Launch permissions 
    
-   Storage for the root device
    

### **Rationale**:

Checks if running instances are using specified AMIs. Amazon Machine Image is a template that contains a preconfigured OS and a well-defined stack of server software fully configured to run your application. Using  Amazon Machine Image to create new EC2 instances within your AWS environment provides major benefits such as fast and stable application deployment and scaling, secure application stack upgrades, and versioning. 

### **Impact**:

AWS Config rules can now check that running instances are using approved Amazon Machine Images or AMIs. You can specify a list of approved AMI by ID or provide a tag to specify the list of AMI Ids.

### **Default Value:**

The default user name is determined by the AMI that was specified when you launched the instance. Checks if running instances are using specified AMIs.

By default, Config rule is disabled.

### **Pre-requisites:**

At least one EC2 should be launched 

### **Remediations:**

### **Test Plan:**

-   **AWS Console Process**
    

1.  Sign in to the AWS Management Console and open the AWS Config console at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/config/ "https://console.aws.amazon.com/config/").
    
2.  In the left navigation, choose **Rules**.
    
3.  Click on a view detail to check APPROVED\_AMIS\_BY\_ID in the rule.
    
4.  If not, go to implementation plan below.
    

-   **Using AWS CLI**
    

1.  Use the command to list the Config rules has APPROVED\_AMIS\_BY\_TAG rule.
    
    aws configservice describe-config-rules
    --query 'Source\[?SourceIdentifier=='APPROVED\_AMIS\_BY\_TAG'\]'
    
    ### **Implementation Plan:**
    
    -   **AWS Console Process**
        

1.  Sign in to the AWS Management Console and open the AWS Config console at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/config/ "https://console.aws.amazon.com/config/").
    
2.  In the left navigation, choose **Rules**.
    
3.  On the **Rules** page, choose **Add rule**.
    
4.  In the general settings select record specific resource types.
    
5.  Click on next.
    
6.  Search APPROVED\_AMIS\_BY\_TAG in the AWS Managed rule search bar, select it.
    
7.  Click on next and click on confirm.
    

-   **Using AWS CLI**
    

Use the `put-config-rule` command with the `--generate-cli-skeleton` parameter to create a local JSON file that has the parameters for your rule:

`aws configservice put-config-rule --generate-cli-skeleton > putConfigRule.json`

For example, the following JSON code updates the resource types that are in the scope of a custom rule:

{
    "ConfigRuleName": "approved-amis-by-id",
    "Description": "A config rule that checks whether running instances are using specified AMIs. Specify a list of approved AMI IDs. Running instances with AMIs that are not on this list are noncompliant.",
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "APPROVED\_AMIS\_BY\_TAG",
        "SourceDetails": \[\]
    },
    "Scope": {
        "ComplianceResourceTypes": \[
            "AWS::EC2::Instance"
        \]
    },
    "InputParameters": "{}"
}

And put the config rule by using below command. 

 aws configservice put-config-rule --cli-input-json file://putConfigRule.json

### **Backout plan:**

-   **AWS Console Process**
    

1.  Sign in to the AWS Management Console and open the AWS Config console at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/config/ "https://console.aws.amazon.com/config/").
    
2.  In the left navigation, choose **Rules**.
    
3.  Choose a rule from the table that you want to delete.
    
4.  From the **Actions** dropdown list, choose **Delete rule**.
    
5.  When prompted, type "Delete" (case-sensitive) and then choose **Delete**.
    

-   **Using AWS CLI**
    

Use the `delete-config-rule` command as shown in the following example:

aws configservice delete-config-rule 
--config-rule-name ConfigRuleName
--query 'Source\[?SourceIdentifier=='APPROVED\_AMIS\_BY\_TAG'\]'

### **Reference:**

**[https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.htm](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.htm)**

**[https://docs.aws.amazon.com/cli/latest/reference/ec2/create-image.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-image.html)**

**[https://docs.aws.amazon.com/cli/latest/reference/ec2/deregister-image.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/deregister-image.html)**

**[https://docs.aws.amazon.com/config/latest/developerguide/approved-amis-by-tag.html](https://docs.aws.amazon.com/config/latest/developerguide/approved-amis-by-tag.html)**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.