# Cis AWS Compute 2.1.5

> Cis AWS Compute 2.1.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure Images are not Publicly Available

- Skill name: `cis-aws-compute-2.1.5`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.1.5/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure Images are not Publicly Available

## Description

EC2 allows you to make an AMI public, sharing it with all AWS accounts.

## Rationale

Publicly sharing an AMI with all AWS accounts could expose organizational data and configuration information.

## Impact

Making an AMI private may affect other AWS accounts that depend on it. Ensure shared accounts are explicitly added if needed.

## Audit Procedure

### Using AWS CLI

No specific CLI audit command is provided for this control. Use the console method below.

### Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane, under `Images`, click `AMIs`.
3. Confirm the `Owned by me` is set.
4. Select the AMI from the list.
5. Click on the `Permissions` Tab.
6. If this reads `This image is currently Public`, please refer to the remediation below.

## Expected Result

All AMIs should have their permissions set to Private. No AMI should display "This image is currently Public" in the Permissions tab.

## Remediation

### Using AWS CLI

No specific CLI remediation command is provided for this control. Use the console method below.

### Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane, under `Images`, click `AMIs`.
3. Confirm the `Owned by me` is set.
4. Select the AMI from the list.
5. Click on the `Permissions` Tab.
6. Click on `Edit`.
7. Click on the radio button `Private`.

Add AWS Account Number if you have a need to share with other Internal AWS accounts that your Organization owns.

## Default Value

By default, AMIs are private when created. They must be explicitly made public.

## References

1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharing-amis.html

## CIS Controls

| Controls Version | Control                          | IG 1 | IG 2 | IG 3 |
| ---------------- | -------------------------------- | ---- | ---- | ---- |
| v8               | 11.3 Protect Recovery Data       | x    | x    | x    |
| v7               | 5.3 Securely Store Master Images |      | x    | x    |

## Profile

Level 1 | Manual

---

Source: https://www.openparable.com/skill/devops-security/cis-aws-compute-2-1-5 (OpenParable). Cite the canonical URL above.