Back to Checks
aws

EC2 AMI owned by the account is not public

ec2_ami_public
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

EC2 AMIs owned by the account are evaluated for public visibility via their launch permissions. Images shared with all accounts (Group=all) are treated as publicly accessible.

Prowler logoProwlerprowler-provider-aws

Risk

Public AMIs expose image contents to any AWS account, undermining confidentiality and integrity:

  • Leakage of embedded secrets, configs, or data from referenced snapshots
  • Adversaries can fingerprint your stack, aiding targeted exploits or repackaging for supply chain abuse

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ami_public

Recommendation

Keep AMIs private and enforce least privilege launch permissions. Share only with specific accounts and review access routinely. Enable block public access for AMIs, sanitize images to remove secrets, encrypt backing snapshots, and apply lifecycle governance to retire outdated images.

Remediation

CLI

aws ec2 modify-image-attribute --image-id <EC2_AMI_ID> --launch-permission "Remove=[{Group=all}]"

Other

1Open the Amazon EC2 console and go to AMIs
2Select the AMI with Visibility = Public
3Click Actions > Edit AMI permissions
4Under AMI availability, select Private
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ami_public(Check):
    def execute(self):
        findings = []
        for image in ec2_client.images:
            if image.owner == "self":
                report = Check_Report_AWS(metadata=self.metadata(), resource=image)
                report.status = "PASS"
                report.status_extended = (
                    f"EC2 AMI {image.name if image.name else image.id} is not public."
                )
                if image.public:
                    report.status = "FAIL"
                    report.status_extended = f"EC2 AMI {image.name if image.name else image.id} is currently public."

                findings.append(report)

        return findings

References