Exams / SOA-C03 / Study guide / AMIs, Image Builder and container images

AMIs, Image Builder and container images: SOA-C03 study notes and practice questions

What to know about AMIs, Image Builder and container images for the SOA-C03 exam, from the Deployment, Provisioning, and Automation domain (22% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.

Last verified October 2026 against current AWS documentation ·How we write our questions

What to know for the exam

Image questions ask how to build consistent, patched server images and get them to other Regions and accounts.

AMIs

An AMI contains EBS snapshots of the instance’s volumes plus launch settings. AMIs are regional; copy them to use in other Regions.
Share an AMI with specific accounts or an organization. If it’s encrypted, share the customer managed KMS key too; AMIs encrypted with the AWS managed EBS key can’t be shared.
Deregistering an AMI doesn’t delete its snapshots; delete them separately to stop paying.
AMI deprecation hides old AMIs from new launches; Recycle Bin can protect deregistered AMIs.
Use Systems Manager Parameter Store public parameters to find the latest AWS-provided AMI IDs (for example, the latest Amazon Linux) instead of hard-coding IDs.

EC2 Image Builder

Builds golden images automatically through a pipeline: recipe (base image + components for build and test steps), infrastructure configuration, and distribution settings (Regions, accounts, launch template updates).
Runs on a schedule or when a new base image is released, so images stay patched.
Can build container images and push them to Amazon ECR.
Tests images before distributing; failing images don’t ship.

Containers

Amazon ECR stores container images: image scanning (basic or enhanced with Amazon Inspector), lifecycle policies to expire old images, replication across Regions and accounts, and immutable tags to stop tags being overwritten.

Golden image vs bootstrapping

Baking software into an AMI makes launches fast, important for Auto Scaling.
User data scripts install at launch: flexible but slower.
A mix is common: bake the slow parts, configure the rest at launch.

Common traps

Using an AMI in another Region without copying it.
Sharing an AMI encrypted with the default key.
Thinking deregistering an AMI deletes its snapshots.

Try the 1 practice question

Practice AMIs, Image Builder and container images Take the free practice exam

Question 1

Medium ·Link to this question

A dental chain launches its practice-management servers from a hardened Amazon Linux AMI.

Today an engineer builds the AMI by hand each month, installs the latest patches and the CloudWatch agent, runs a test script, and then copies the AMI to three Regions and shares it with four accounts.

Builds are often late and sometimes skip the tests. The chain wants this automated with the LEAST operational overhead.

What should a CloudOps engineer do?

Choose one answer.

A. Create an EC2 Image Builder pipeline with build and test components, a monthly schedule, and distribution settings for the three Regions and four accounts.
B. Write a Lambda function that calls CreateImage on a reference instance every month, then copies and shares the result with each Region and account.
C. Use Amazon Data Lifecycle Manager with an AMI policy that creates a new AMI from the reference instance every month and copies it to three Regions.
D. Run HashiCorp Packer on a dedicated EC2 build instance with a cron job, and copy the resulting AMI to each Region with an AWS CLI script.

Show the answer and explanation

Answer: A

A. Right: Correct. Image Builder runs build components, such as patching and agent install, and test components on a schedule. Its distribution settings copy the AMI to Regions and share it with accounts, all as a managed service. Learn more: Manage EC2 Image Builder distribution settings (opens in a new tab)
B. Wrong: CreateImage captures whatever is on the reference instance, so patching and testing still have to be scripted separately. The team would also maintain the copy and share logic itself. Learn more: Copy an Amazon EC2 AMI (opens in a new tab)
C. Wrong: DLM AMI policies create and retain AMIs from tagged instances on a schedule, but they do not patch the instance or run tests. The build steps the chain needs would still be manual. Learn more: Amazon Data Lifecycle Manager (opens in a new tab)
D. Wrong: Packer can build and test images, but the team would run and patch the build server and maintain the scripts themselves. That is more overhead than a managed pipeline. Learn more: What is EC2 Image Builder? (opens in a new tab)

Explanation

EC2 Image Builder is the managed service for golden image pipelines. Components describe the build and test steps, a schedule runs the pipeline, and distribution settings copy and share the AMI across Regions and accounts. Custom scripts, DLM and self-managed tools can each cover part of the process but leave work for the team.

Study

Want more on AMIs, Image Builder and container images? The 5 full-length practice sets have 10 more AMIs, Image Builder and container images questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study AMIs, Image Builder and container images

What is EC2 Image Builder?