Back to Checks
aws

AMI block public access is enabled at the account level

ec2_ami_account_block_public_access
Service: ec2Severity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

AMI block public access configuration is assessed to see whether public sharing of AMIs is blocked in the account and Region. When enabled (block-new-sharing), no AMI in the Region can be made public regardless of individual image permissions.

Prowler logoProwlerprowler-provider-aws

Risk

Without blocking public access, AMIs could be accidentally or maliciously shared publicly, exposing baked-in secrets, source code, and infrastructure details to unauthorized actors.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ami_account_block_public_access

Recommendation

Enable AMI block public access (block-new-sharing) in every active Region. Apply guardrails (SCPs) to prevent it from being disabled, and review any AMIs that are currently shared publicly.

Remediation

CLI

aws ec2 enable-image-block-public-access --image-block-public-access-state block-new-sharing

Terraform

resource "aws_ec2_image_block_public_access" "<example_resource_name>" {
  state = "block-new-sharing" # Blocks new public sharing of AMIs in the configured Region
}

Other

1In the AWS console, select the target Region in the top-right.
2Go to EC2 > AMIs.
3In the AMIs page, choose Block public access for AMIs (or EC2 Dashboard > Account attributes > Data protection and security).
4Choose Manage and enable Block public access.
5Save changes.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ami_account_block_public_access(Check):
    def execute(self):
        findings = []
        for state in ec2_client.ami_block_public_access_states:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=state,
            )
            report.resource_id = ec2_client.audited_account
            report.resource_arn = ec2_client.account_arn_template

            if state.status == "block-new-sharing":
                report.status = "PASS"
                report.status_extended = (
                    f"AMI Block Public Access is enabled in {state.region}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"AMI Block Public Access is disabled in {state.region}."
                )

            findings.append(report)

        return findings

References