Check ID:
Provider: AWS
Service:
Severity: CRITICAL
Categories:
Resource type:
ec2_ami_publicProvider: AWS
Service:
ec2Severity: CRITICAL
Categories:
internet-exposedResource type:
OtherWhat this check verifies
EC2 AMIs owned by the account are evaluated for public visibility via their launch permissions. Images shared with all accounts (Group=all) are treated as publicly accessible.
Risk
Public AMIs expose image contents to any AWS account, undermining confidentiality and integrity:- Leakage of embedded secrets, configs, or data from referenced snapshots
- Adversaries can fingerprint your stack, aiding targeted exploits or repackaging for supply chain abuse
Recommendation
Keep AMIs private and enforce least privilege launch permissions. Share only with specific accounts and review access routinely. Enable block public access for AMIs, sanitize images to remove secrets, encrypt backing snapshots, and apply lifecycle governance to retire outdated images.Remediation
- CLI
- Dashboard steps
References
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cancel-sharing-an-AMI.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html
- https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = ec2_ami_public. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks