Cis AWS Compute 2.1.4

Ensure Images (AMI) are not older than 90 days

Description

Ensure that your AMIs are not older than 90 days.

Rationale

Using up-to-date AMIs will provide many benefits from OS updates and security patches helping to ensure reliability, security and compliance.

Impact

Outdated AMIs must be replaced by creating new images from updated instances. This requires a refresh cycle that involves launching instances, applying updates, creating new AMIs, and deregistering old ones.

Audit Procedure

Using AWS CLI

Run the aws ec2 describe-images command:

aws ec2 describe-images \
    --region <region> \
    --image-ids <image-ID>

Look for CreationDate in response. If the age of the selected AMI is greater than 90 days, the AMI is considered outdated and it should be updated.

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane, under Images, click AMIs.
3. Select the AMI for review.
4. Under the Details tab.
5. Review the Creation date.

If the age of the selected AMI is greater than 90 days, the AMI is considered outdated and it should be updated.

6. Repeat steps no. 3 - 5 to verify the date of the other approved AMIs available.

Repeat all steps for the other regions.

Expected Result

All AMIs should have a CreationDate within the last 90 days. Any AMI older than 90 days is considered non-compliant and should be updated.

Remediation

Using AWS CLI

No specific CLI remediation command is provided. Follow the console steps below to update AMIs.

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane, under Images, click AMIs.
3. Select the AMI to be updated.
4. Click on Launch.
5. Go through the EC2 Instance creation process.
6. Apply all system, security and application updates that are applicable to the EC2 instance.
7. Once completed click on Instance state, Stop instance.
8. Click on Actions, Image and templates, Create image.
9. Once the image process has complete return to the AMI list but clicking on Images, AMIs.
10. Select the AMI that is older than 90 days.
11. Click on Actions, Deregister.

Repeat these steps for any other AMIs older than 90 days.

Default Value

AWS does not enforce any default age limit on AMIs.

References

1. https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html
2. https://docs.aws.amazon.com/cli/latest/reference/ec2/deregister-image.html

CIS Controls

Profile

Level 1 | Automated