OpenParable
Skip to content
← Back to skills

Cis AWS Compute 2.1.5

DevOps & Security
cis-aws-compute-2.1.5

Cis AWS Compute 2.1.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure Images are not Publicly Available

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.1.5/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-compute-2-1-5, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure Images are not Publicly Available

Description

EC2 allows you to make an AMI public, sharing it with all AWS accounts.

Rationale

Publicly sharing an AMI with all AWS accounts could expose organizational data and configuration information.

Impact

Making an AMI private may affect other AWS accounts that depend on it. Ensure shared accounts are explicitly added if needed.

Audit Procedure

Using AWS CLI

No specific CLI audit command is provided for this control. Use the console method below.

Using AWS Console

  1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
  2. In the left pane, under Images, click AMIs.
  3. Confirm the Owned by me is set.
  4. Select the AMI from the list.
  5. Click on the Permissions Tab.
  6. If this reads This image is currently Public, please refer to the remediation below.

Expected Result

All AMIs should have their permissions set to Private. No AMI should display "This image is currently Public" in the Permissions tab.

Remediation

Using AWS CLI

No specific CLI remediation command is provided for this control. Use the console method below.

Using AWS Console

  1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
  2. In the left pane, under Images, click AMIs.
  3. Confirm the Owned by me is set.
  4. Select the AMI from the list.
  5. Click on the Permissions Tab.
  6. Click on Edit.
  7. Click on the radio button Private.

Add AWS Account Number if you have a need to share with other Internal AWS accounts that your Organization owns.

Default Value

By default, AMIs are private when created. They must be explicitly made public.

References

  1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharing-amis.html

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v811.3 Protect Recovery Dataxxx
v75.3 Securely Store Master Imagesxx

Profile

Level 1 | Manual