Cis AWS Compute 2.1.1

Ensure Consistent Naming Convention is used for Organizational AMI

Description

The naming convention for AMI (Amazon Machine Images) should be documented and followed for any AMI's created.

Rationale

The majority of AWS resources can be named and tagged. Most organizations have already created standardize naming conventions, and have existing rules in effect. They simply need to extend that for all AWS cloud resources to include Amazon Machine Images (AMI).

Impact

No significant operational impact. This is an organizational best practice that improves manageability and consistency of AMI resources.

Audit Procedure

Using AWS CLI

1. Run aws ec2 describe-images.

aws ec2 describe-images --owner self --region us-west-2

2. Review the list of AMIs.
3. Confirm that the AMI Name matches the organizational image naming policy.

If any of the AMI Name's do not match the Organization policy refer to the remediation below.

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane, under Images, click AMIs.
3. Review the list of AMIs.
4. Confirm that the AMI Name matches the organizational image naming policy.

Expected Result

All AMI names should follow the organization's documented naming convention. The output of describe-images should show AMIs with consistent, policy-compliant names.

Remediation

Using AWS CLI

No specific CLI remediation command is provided. Use the console method to copy and rename AMIs that do not comply with the naming policy.

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane click Images, click AMIs.
3. Select the AMI that does not comply to the naming policy.
4. Click on Actions.
5. Click on Copy AMI.

Destination region - Select the region the AMI is in.
Name - `Enter the new Name`
Description - `Enter the new description`
Encryption - `Select` if it matches your image policy

6. Click on Copy AMI

Once the AMI has finished copying:

7. Select the AMI that does not comply to the naming policy.
8. Click on Actions.
9. Click on Deregister.

Default Value

AWS does not enforce any default naming convention for AMIs.

References

1. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html
2. https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/AMIs.html

CIS Controls

Profile

Level 1 | Manual