Demo EC2 Image Builder in Action

• Automates image creation and configuration with reusable components.
• Provides built-in test and validation phases to reduce drift and configuration errors.
• Enables versioned image pipelines and lifecycle rules for cleanup.
• Supports cross-region and cross-account distribution with KMS encryption support.

​

Architecture — five main components

1. Image pipelines — the orchestration layer that ties a recipe, infrastructure configuration, distribution settings, and a schedule together. Pipelines run the build workflow when triggered (manually, scheduled, or via EventBridge).

2. Image recipes — define the base image and the components (both build and test components) to run during the build.

3. Components — reusable building blocks defined as small YAML documents. Components run actions such as installing packages, configuring files, running scripts, downloading/uploading artifacts, or running assertions. Use components in both build and test phases.
4. Infrastructure configuration — specifies how the ephemeral build instance is launched (instance type, VPC/subnet, IAM role, key pair, security groups, logging, etc.). Image Builder launches a temporary EC2 instance to perform the build and then terminates it.

5. Distribution settings — define where built images are published (regions, accounts), any AWS KMS keys for encryption, launch templates, and other distribution options.

• Pipeline triggers (manual, scheduled, or EventBridge).
• Infrastructure configuration launches a temporary EC2 build instance (for example, t3.medium).
• The recipe’s build components run in the defined order.
• Test components run to validate the image. Tests must return success; otherwise the image is not published.
• If tests pass, Image Builder creates and optionally distributes the AMI per your distribution settings.
• The ephemeral build instance is terminated.

​

Components — build and test examples

# Build component example (YAML)
schemaVersion: "1.0"
name: devops-020-240-app-dependencies
description: Install runtime dependencies and create application directory
phases:
  - name: build
    steps:
      - name: InstallPython
        action: ExecuteBash
        inputs:
          commands:
            - echo "Installing Python 3.11..."
            - dnf install -y python3.11 python3.11-pip
      - name: InstallNodeJS
        action: ExecuteBash
        inputs:
          commands:
            - echo "Installing Node.js..."
            - dnf install -y nodejs
      - name: InstallDocker
        action: ExecuteBash
        inputs:
          commands:
            - echo "Installing Docker..."
            - dnf install -y docker
            - systemctl enable docker
      - name: InstallCodeDeployAgent
        action: ExecuteBash
        inputs:
          commands:
            - echo "Installing CodeDeploy agent..."
            - dnf install -y ruby wget
            - cd /tmp
            - wget https://aws-codedeploy-us-east-1.s3.us-east-1.amazonaws.com/latest/install
            - chmod +x ./install
            - ./install auto
            - systemctl enable codedeploy-agent
      - name: CreateAppDirectory
        action: ExecuteBash
        inputs:
          commands:
            - mkdir -p /opt/myapp
            - chown ec2-user:ec2-user /opt/myapp

# Test component example (YAML)
schemaVersion: "1.0"
name: devops-020-240-validation
description: Validate installed packages and application directory
phases:
  - name: test
    steps:
      - name: ValidatePython
        action: ExecuteBash
        inputs:
          commands:
            - echo "Validating Python installation..."
            - python3.11 --version || exit 1
      - name: ValidateNode
        action: ExecuteBash
        inputs:
          commands:
            - echo "Validating Node.js installation..."
            - node --version || exit 1
      - name: ValidateDocker
        action: ExecuteBash
        inputs:
          commands:
            - echo "Validating Docker installation..."
            - docker --version || exit 1
      - name: ValidateCodeDeployAgent
        action: ExecuteBash
        inputs:
          commands:
            - echo "Validating CodeDeploy agent..."
            - systemctl is-enabled codedeploy-agent || exit 1
      - name: ValidateAppDirectory
        action: ExecuteBash
        inputs:
          commands:
            - echo "Validating application directory..."
            - test -d /opt/myapp || exit 1

# Simple test component example
name: HelloWorldTestingDocument
description: This is hello world testing document.
schemaVersion: "1.0"
phases:
  - name: test
    steps:
      - name: HelloWorldStep
        action: ExecuteBash
        inputs:
          commands:
            - echo "Hello World! Test."

​

Image recipes and component versioning

• Base image (AWS-managed AMI, Marketplace, shared AMI, or a custom AMI).
• Build components and their specific versions.
• Test components for validation.
• Additional storage volumes, working directory, and metadata tags.
• Reboot behavior (many components include a reboot component when required).

​

Distribution settings and sharing

• Publish AMIs to multiple regions and accounts.
• Encrypt AMIs with an AWS KMS key for secure sharing.
• Attach launch templates or specify launch permissions (private, shared accounts/organizational units, or public).
• Integrate with license management and Systems Manager (SSM) for instance inventory and run commands.

​

Pipelines — scheduling, triggers, and security scanning

• Manual runs, scheduled runs (cron-like), or EventBridge-triggered runs.
• Vulnerability scanning and security snapshots during the build.
• Enhanced metadata collection and logging to Amazon S3 or Amazon CloudWatch.

​

Lifecycle policies and versioning

• Auto-version recipes on updates.
• Retain a fixed number of image versions.
• Delete images older than a specified age to control image sprawl.

​

Quick reference — key features

​

Summary

• Author components (build and test) as YAML documents.
• Create recipes that assemble base images and ordered components.
• Configure ephemeral build infrastructure and pipelines to orchestrate builds.
• Use distribution settings and KMS for secure publishing.
• Apply lifecycle policies to manage image retention and cleanup.

• EC2 Image Builder documentation: https://docs.aws.amazon.com/imagebuilder/
• EventBridge: https://aws.amazon.com/eventbridge/
• Amazon S3: https://aws.amazon.com/s3/
• AWS KMS: https://aws.amazon.com/kms/
• AWS Systems Manager (SSM): https://aws.amazon.com/systems-manager/