Prevent certain AWS AMI from accidental deletion

user_11441337 0
Viewed 1261

When cleaning up the old/unused resources, at times we may get into trouble deleting the used/current AMIs. Have to prevent the accidental delete/deregister of the AMIs.

I was thinking to add a tag to the AMI which should never be deleted if that tags exist.

In a similar fashion to instance termination protection, I would like the ability to have CERTAIN AMI's have a double failsafe mechanism to avoid accidental deletion.

Please suggest a way for the same.

amazon-ami amazon-web-services delete-file
1 Answers

Update: DeregisterImage() now does have Condition Keys, so this answer is out-of-date.

Based on Actions, Resources, and Condition Keys for Amazon EC2 - AWS Identity and Access Management, it appears that DeregisterImage() does not have any Condition Keys.

Therefore, it looks like it would not be possible to restrict this command only to certain AMIs or tags.

Some options:

  • Restrict this permission only to certain trusted users, or
  • Put the AMI in a separate AWS account where users can access it (via sharing), but have no permission to delete it
user_1747770
Related