20

I've been using AWS for years, but have never ventured outside the Quick Start and AWS Marketplace sections when launching an EC2 instance.

The AMIs from the AWS Marketplace look trustable, they have a link to the seller profile, etc.:

enter image description here

Compare this to community AMIs, that seem to appear out of thin air, with no information whatsoever on who the heck created and uploaded it:

enter image description here

How to know where a Community AMI comes from? Can these be trusted?

BenMorel
  • 4,507
  • 10
  • 57
  • 85
  • 5
    I know this isn't your question, but if you're looking for hardened images from a reputable source look at the [CIS Hardened Images](https://www.cisecurity.org/cis-hardened-images/amazon/). They have images for most large cloud providers. – Tim Aug 03 '19 at 21:03

2 Answers2

23

Any AWS user can create a community AMI by making it public and shared with everyone. So the answer is just about anyone could have created that community AMI.

While many are probably fine, you cannot trust them by default, in my opinion.

Regarding the specific creator of the AMI in question, it appears that the only user-specific information available is the OwnerId field, which is the AWS account ID of the image owner.

Here's an example AWS Cli command to get that information:

aws ec2 describe-images  --image-ids ami-gs5mba4yp26bsyx57

(Replace "gs5mba4yp26bsyx57" with the ami id you want to examine.)

This will return a lot of information about the image, including the OwnerId field.

Community
  • 1
vjones
  • 851
  • 7
  • 13
  • 1
    Thanks for the pointer. So as I understand it, anyone can put anything in there, without any verification from AWS, so these images cannot be trusted, and there is absolutely no way to know *who* created them? – BenMorel Aug 03 '19 at 14:57
  • So far as I can tell, you can only determine the Account ID of the creator. I added this information to my answer. – vjones Aug 03 '19 at 15:27
6

and there is absolutely no way to know who created them?

You are looking in the wrong direction! Your trust in community AMIs should come from outside Amazon. For example, if you trust getfedora.org, you can trust the community AMIs it references (as noted in this answer to a closely related question, though the link has since broken).

Similarly Ubuntu has https://cloud-images.ubuntu.com/locator/ec2/ (though I'm not sure if those AMIs are community or not).

There are plenty of other projects which list their own "official" community AMIs. I couldn't find an official list for CentOS which might include the AMI you referenced in the post, but you can always try asking the project maintainers if the AMI was created by them in an official capacity.

Dave
  • 161
  • 3
  • Sure, looking at it this way is OK, and TBH it's kind of weird that EC2 offers a search engine that returns community AMIs, they could just allow you to use them if you know their ID. I guess this might be useful to try out some things where security doesn't matter. – BenMorel Aug 05 '19 at 14:43
  • 3
    Agreed; I don't know why they offer a search by anything other than the AMI ID itself. Discovering them that way is just inherently risky. – Dave Aug 05 '19 at 17:26