Deployment and Automation · Topic 3 of 7
AMIs, Launch Templates and Image Builder
Build, share and copy AMIs, bootstrap with user data, define launches with launch templates and automate golden image pipelines with EC2 Image Builder.
- 5 min
- An AMI is Regional, so copy it to use it in another Region.
- Share an AMI by adding account IDs to launch permissions, and share the customer managed KMS key if it is encrypted.
- Deregistering an AMI does not delete its snapshots.
What it is
An Amazon Machine Image (AMI) is the template an EC2 instance starts from. It holds the operating system, installed software and the block device mapping, which lists the volumes to attach.
A launch template stores the other launch settings, so you can start identical instances again and again. EC2 Image Builder automates building and testing new AMIs.
How it works
AMIs
An AMI belongs to one Region. To use it elsewhere, copy it to the target Region, which gives a new AMI ID there. An AMI backed by EBS (Elastic Block Store) refers to snapshots of its volumes.
You can share an AMI with other accounts by adding their account IDs to its launch permissions. Sharing an AMI whose snapshots are encrypted also needs the KMS (Key Management Service) key to be shared, and it must be a customer managed key, not the default AWS managed key.
# AWS CLI: create an AMI from a running instance, then copy it
aws ec2 create-image --instance-id i-0123456789abcdef0 --name web-v2
aws ec2 copy-image --source-image-id ami-0abc1234def567890 \
--source-region us-east-1 --region eu-west-1 --name web-v2Removing an AMI means deregistering it. The snapshots stay until you delete them, so clean up both to avoid cost.
Golden AMI or bootstrapping
| Approach | Strength | Weakness |
|---|---|---|
| Golden AMI | Fast launch, consistent, already patched and tested | Must be rebuilt for each change |
| Bootstrapping with user data | Flexible, always fetches current config | Slower launch, depends on external sources at boot |
| Mix of both | Base software in the AMI, small config at boot | Needs a build process |
User data is a script or cloud config that runs at first boot, with root rights, by default only on the first start. Auto Scaling needs fast scale out, so a golden AMI with a small user data script is a common design.
Launch templates
A launch template holds the AMI, instance type, key pair, security groups, storage, IAM instance profile, user data, tags and more. Templates have versions, and a group can follow $Latest, $Default or a fixed number.
Launch templates are the current way to launch instances and Auto Scaling groups. Launch configurations are the older form, cannot be versioned and are legacy, so choose launch templates in new designs. Only launch templates support newer features, such as multiple instance types with Spot and On Demand mixes in one group.
To roll out a new AMI to a running Auto Scaling group, create a new template version and start an instance refresh.
EC2 Image Builder
Image Builder is a managed service that builds, tests and distributes images on a schedule or when the parent image updates. Its main objects are:
- Components: the steps that install or configure software, or run tests.
- Image recipe: a base image plus an ordered list of components.
- Infrastructure configuration: where the build instance runs, with its subnet, security group and role.
- Distribution settings: which Regions and accounts receive the finished image.
- Pipeline: ties these together and runs on a schedule.
Image Builder can produce container images as well as AMIs.
Finding the latest AMI
AWS publishes public Systems Manager parameters that always point to the current Amazon Linux AMI. A launch template or CloudFormation template can read them, so you never hard code an ID.
/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64When a question asks for consistent, patched, tested images built on a schedule with the least effort, think EC2 Image Builder.
What to remember for the exam
- An AMI is Regional, so copy it to use it in another Region.
- Share an AMI by adding account IDs to launch permissions, and share the customer managed KMS key if it is encrypted.
- Deregistering an AMI does not delete its snapshots.
- User data runs at first boot by default and runs with root rights.
- Golden AMIs speed up launches, and user data adds small last mile configuration.
- Launch templates are versioned, and launch configurations are legacy.
- An instance refresh rolls out a new template version to an Auto Scaling group.
- EC2 Image Builder uses components, recipes, infrastructure configuration, distribution settings and pipelines.
- Public SSM parameters hold the latest AWS provided AMI IDs.
Common mistakes
Using one AMI ID in all Regions. The ID differs per Region, so copy the image or look it up with a parameter.
Sharing an encrypted AMI without the key. The other account sees the AMI but cannot launch it.
Putting long install steps in user data for an Auto Scaling group. Scale out becomes slow. Bake the software into the AMI.
Updating a template and expecting running instances to change. Only new launches use the new version, until you refresh.
Forgetting to delete old snapshots. Deregistered AMIs leave storage charges behind.
Secrets placed in user data can be read by anyone with access to the instance metadata or the launch template. Keep them in Secrets Manager or Parameter Store.
Check yourself
Quick questions.
How do you use an AMI in a second Region?
Copy the AMI to that Region, which creates a new AMI ID there.
What replaces a launch configuration in new designs?
A launch template, which supports versions and newer features.
Which service builds and tests golden AMIs on a schedule?
EC2 Image Builder.
Topic 3 of 7 in Deployment and Automation
Test yourself on Deployment and Automation
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.