AMI is publicly shared

Severity: High
Service: EC2
Check ID: AMI_PUBLIC

What this check finds

An AMI is used to install the OS for an EC2 instance. These may contain sensitive information. These are very easy for attackers to find.

Passing looks like: AMIs are private.

How to fix it

Make the AMI private.

AWS CLI

aws ec2 modify-image-attribute --image-id AMI_ID --launch-permission '{"Remove":[{"Group":"all"}]}'

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

EC2 → AMIs → select AMI → Actions → Edit AMI permissions → Private.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to AMI is publicly shared
Framework	Controls
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
SOC 2 — Trust Services Criteria	C1.2 Access Restrictions and Secure Disposal
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More EC2 checks

All EC2 checks