An airline runs its crew-scheduling application on Amazon EC2 instances launched from a golden AMI. Security requires that the AMI be rebuilt every month with the latest operating system patches and the application's installer component.
The new image must be available in three Regions and shared with the production and disaster-recovery accounts. Today an engineer builds the AMI by hand, and the copies in the other Regions are often out of date.
The team wants builds that run on a schedule, record the version of each component, and clean up images that are no longer used.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Write a Lambda function, triggered by a monthly EventBridge schedule, that calls CreateImage on a patched instance, then calls CopyImage once for each Region and modifies the AMI launch permissions for each account.
BB. Create an EC2 Image Builder pipeline with a monthly schedule, a recipe that applies the patch and installer components, and distribution settings for three Regions and both accounts.
CC. Keep a long-running build instance with Packer in a cron job on an EC2 host, and store each finished AMI ID in Systems Manager Parameter Store for the deployment team to read.
DD. Create an AWS CodePipeline pipeline with a monthly trigger that launches an instance from the latest public Amazon Linux AMI, runs the installer script, creates an AMI, and then emails the release lead.
Show the answer and explanation
Answer: B
A. Wrong: This automates the copies, but the team would write and maintain the orchestration, the cleanup and the component tracking. EC2 Image Builder already provides those steps as managed resources. Learn more: What is Image Builder? (opens in a new tab)
B. Right: Correct. Image Builder runs the pipeline on a schedule, versions each component, and distributes the output to several Regions with account sharing set in one place. Lifecycle policies can then remove older images without custom code. Learn more: Manage Image Builder distribution settings (opens in a new tab)
C. Wrong: Packer can build AMIs, but the team would run and patch the build host and write the cron and copy logic. It also has no built-in record of component versions or of which Regions hold each image. Learn more: AWS Systems Manager Parameter Store (opens in a new tab)
D. Wrong: The copies to other Regions and the account sharing would still be manual steps, so the copies would drift. The schedule alone does not give the version records or the cleanup that the team asked for.
Explanation
EC2 Image Builder combines a schedule, versioned components, a recipe and a distribution configuration into one managed pipeline. The distribution settings copy the AMI to several Regions and share it with named accounts, and lifecycle policies remove older images. Scripts, cron jobs and manual copies can do the same work, but each one is code the team must maintain.
Want more on AMI and container image pipelines (EC2 Image Builder)? The 5 full-length practice sets have 8 more AMI and container image pipelines (EC2 Image Builder) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →