ExamPark
Course menuDOP-C02

Exams / DOP-C02 / Study guide / AMI and container image pipelines (EC2 Image Builder)

AMI and container image pipelines (EC2 Image Builder): DOP-C02 study notes and practice questions

What to know about AMI and container image pipelines (EC2 Image Builder) for the DOP-C02 exam, from the SDLC Automation domain (22% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

These questions ask how to produce patched, hardened images on a schedule and get them into use with little manual work.

EC2 Image Builder

Piece Holds
Components Versioned build and test steps (install agents, harden, run tests), YAML documents
Image recipe Base image plus components; container recipes for Docker images
Infrastructure configuration Instance type, subnet, role, logging
Distribution configuration Copy AMIs to other Regions, share with accounts or OUs, update launch templates; push container images to ECR
Pipeline Ties them together on a schedule or when the base image updates
  • Tests run on a launched instance before distribution.
  • Lifecycle policies deprecate and delete old images.
  • Image Builder integrates with Inspector scanning.
  • Notifications go to SNS; image state changes are EventBridge events.

Rolling new images out

  • Distribution can update a launch template’s default version with the new AMI.
  • Auto Scaling instance refresh replaces instances gradually, with checkpoints, minimum healthy percentage and automatic rollback.
  • Store the latest AMI ID in Parameter Store, and reference it from CloudFormation.

Container images

  • Build in CodeBuild (privileged mode) or Image Builder container recipes.
  • Push to ECR, scan, sign and promote.
  • Rebuild regularly to pick up base image patches.

Common traps

  • Hand-built AMIs with no record of what’s installed.
  • Copying AMIs to each Region with scripts when distribution settings do it.
  • Terminating all instances at once to pick up a new AMI. Use instance refresh.
  • Building images on a long-lived instance that drifts from the recipe; Image Builder launches a fresh instance for each build and terminates it.
  • Skipping tests in the recipe, so a broken agent ships in every new instance.

Try the 1 practice question

Practice AMI and container image pipelines (EC2 Image Builder)Take the free practice exam

Question 1

Medium ·Link to this question (question 1)

An airline runs its crew-scheduling application on Amazon EC2 instances launched from a golden AMI. Security requires that the AMI be rebuilt every month with the latest operating system patches and the application's installer component.

The new image must be available in three Regions and shared with the production and disaster-recovery accounts. Today an engineer builds the AMI by hand, and the copies in the other Regions are often out of date.

The team wants builds that run on a schedule, record the version of each component, and clean up images that are no longer used.

Which solution meets these requirements with the LEAST operational overhead?

Choose one answer.

  1. A. Write a Lambda function, triggered by a monthly EventBridge schedule, that calls CreateImage on a patched instance, then calls CopyImage once for each Region and modifies the AMI launch permissions for each account.
  2. B. Create an EC2 Image Builder pipeline with a monthly schedule, a recipe that applies the patch and installer components, and distribution settings for three Regions and both accounts.
  3. C. Keep a long-running build instance with Packer in a cron job on an EC2 host, and store each finished AMI ID in Systems Manager Parameter Store for the deployment team to read.
  4. D. Create an AWS CodePipeline pipeline with a monthly trigger that launches an instance from the latest public Amazon Linux AMI, runs the installer script, creates an AMI, and then emails the release lead.
Show the answer and explanation

Answer: B

  • A. Wrong: This automates the copies, but the team would write and maintain the orchestration, the cleanup and the component tracking. EC2 Image Builder already provides those steps as managed resources. Learn more: What is Image Builder? (opens in a new tab)
  • B. Right: Correct. Image Builder runs the pipeline on a schedule, versions each component, and distributes the output to several Regions with account sharing set in one place. Lifecycle policies can then remove older images without custom code. Learn more: Manage Image Builder distribution settings (opens in a new tab)
  • C. Wrong: Packer can build AMIs, but the team would run and patch the build host and write the cron and copy logic. It also has no built-in record of component versions or of which Regions hold each image. Learn more: AWS Systems Manager Parameter Store (opens in a new tab)
  • D. Wrong: The copies to other Regions and the account sharing would still be manual steps, so the copies would drift. The schedule alone does not give the version records or the cleanup that the team asked for.

Explanation

EC2 Image Builder combines a schedule, versioned components, a recipe and a distribution configuration into one managed pipeline. The distribution settings copy the AMI to several Regions and share it with named accounts, and lifecycle policies remove older images. Scripts, cron jobs and manual copies can do the same work, but each one is code the team must maintain.

Study

Want more on AMI and container image pipelines (EC2 Image Builder)? The 5 full-length practice sets have 8 more AMI and container image pipelines (EC2 Image Builder) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study AMI and container image pipelines (EC2 Image Builder)

More SDLC Automation topics