Ensure that your app-tier Auto Scaling Group (ASG) launch configurations are using approved Amazon Machine Images (AMIs) to launch EC2 instances within the ASG. An approved (golden) AMI is an EC2 image that contains a pre-configured OS and a well-defined software stack, fully configured to run your applications. A list of approved AWS AMIs must be maintained by your organization. This conformity rule assumes that all AWS resources created for your app tier are tagged with <app_tier_tag>:<app_tier_tag_value>, where <app_tier_tag> represents the tag name and <app_tier_tag_value> represents the tag value. Prior to running this rule by the Cloud Conformity engine, the app-tier tags and the IDs of the approved AMIs maintained by your organization must be configured in the rule settings, on your Cloud Conformity account dashboard.
Using golden Amazon Machine Images to launch new EC2 instances within your app-tier Auto Scaling Groups brings security and organizational benefits such as fast application deployment and scaling, secure application stack upgrades and versioning. Ensure that your app-tier ASG launch configuration specifies an approved/golden AMI so that all EC2 instances provisioned within the ASG enforce consistency and follows best practices.
Note: Make sure that you replace all <app_tier_tag>:<app_tier_tag_value> tag placeholders found in the conformity rule content with your own tag name and value created for the app tier.
To determine if your app-tier ASG are using launch configurations with approved AMIs, perform the following actions:
Remediation / Resolution
To launch EC2 instances inside your app-tier Auto Scaling Group from approved Amazon Machine Images, you must re-create the app-tier ASG launch configuration and configure it to support a golden AMI maintained and approved by your organization. If there are no golden AMIs already available within your AWS account, follow the instructions outlined in this conformity rule to create the necessary AMIs. To set up a new app-tier ASG launch configuration, perform the following actions:
- AWS Documentation
- Auto Scaling Groups
- Launch Configurations
- Creating a Launch Configuration
- CIS Amazon Web Services Foundations
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Use Approved AMIs for App-Tier ASG Launch Configurations
Risk level: High