Can Amazon EC2 Block Public Sharing of AMIs?

Amazon Elastic Compute Cloud allows administrators to prevent the accidental exposure of Amazon Machine Images by enabling the block public access setting at the AWS account level. This regional security configuration ensures that no new machine images within the specified account and region can be shared publicly, while keeping any previously public images accessible unless explicitly modified. This guide covers how the account-level block works, its effect on existing images, how to configure it using the command line and infrastructure as code, and how to enforce it across an organization.

How Account-Level Block Public Access Works for AMIs

An Amazon Machine Image (AMI) contains the operating system, application server, and applications required to launch an EC2 instance. Because AMIs often contain proprietary source code, internal configurations, or embedded credentials, making an AMI public by mistake poses a severe security risk.

To mitigate this risk, Amazon EC2 provides an account-level Block Public Access (BPA) setting specifically for AMIs. Key operational characteristics include:

• Regional Scope: The setting is applied per AWS account and per AWS Region. To protect an entire account globally, you must enable the setting in every active AWS Region.
• Default State: By default, every AWS account starts in the off (unblocked) state, meaning users with appropriate IAM permissions can modify image launch permissions to make an AMI public.
• Available States: The setting supports two primary states when configuring it via the API or CLI: block-new-sharing (which prevents any AMI from being made public going forward) and unblocked (which removes the account-level restriction).
• No Effect on Private Sharing: Blocking public access only restricts sharing an AMI with everyone (all). You can still share AMIs privately with specific AWS account IDs, AWS Organizations, or organizational units (OUs).

When calculating the total number of configuration calls \(N_{\text{calls}}\) required to secure an entire multi-account environment across \(A\) accounts and \(R\) enabled regions, the relationship is defined using MathJax as:

\[N_{\text{calls}} = A \times R\]

Impact on Existing Public AMIs vs. New AMIs

Enabling the block-new-sharing state is designed to be non-disruptive to existing workloads that may already rely on publicly shared images.

If an account already has public AMIs when you enable block-new-sharing, those AMIs remain public. However, if you later change an existing public AMI to private, you will not be able to make it public again while the block-new-sharing setting remains active.

Required IAM Permissions

To view or modify the AMI Block Public Access setting at the account level, an IAM principal requires specific Amazon EC2 permissions:

• ec2:GetImageBlockPublicAccessState: Allows viewing the current account-level block status in a region.
• ec2:EnableImageBlockPublicAccess: Allows setting the state to block-new-sharing.
• ec2:DisableImageBlockPublicAccess: Allows reverting the state to unblocked.

Below is an example IAM policy that grants an administrator permission to check and enable the block across all regions, while denying the ability to disable it:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCheckAndEnableAMIBPA",
      "Effect": "Allow",
      "Action": [
        "ec2:GetImageBlockPublicAccessState",
        "ec2:EnableImageBlockPublicAccess"
      ],
      "Resource": "*"
    },
    {
      "Sid": "PreventDisablingAMIBPA",
      "Effect": "Deny",
      "Action": "ec2:DisableImageBlockPublicAccess",
      "Resource": "*"
    }
  ]
}

Checking and Enabling AMI Block Public Access via AWS CLI

You can inspect and update the setting using the AWS Command Line Interface (AWS CLI).

1. Check the Current State

Run the get-image-block-public-access-state command to verify whether public sharing is currently blocked in a specific region:

aws ec2 get-image-block-public-access-state \
  --region us-east-1

If the feature is not yet enabled, the output returns unblocked:

{
    "ImageBlockPublicAccessState": "unblocked",
    "ManagedBy": "account"
}

Note the ManagedBy field: it indicates account when managed directly within the AWS account, or declarative-policy if enforced centrally via AWS Organizations declarative policies.

2. Enable Block Public Access

Use the enable-image-block-public-access command with the --image-block-public-access-state parameter set to block-new-sharing:

aws ec2 enable-image-block-public-access \
  --image-block-public-access-state block-new-sharing \
  --region us-east-1

The command returns the new state:

{
    "ImageBlockPublicAccessState": "block-new-sharing"
}

It can take a few minutes for the state change to propagate across the region. Once active, any attempt to run modify-image-attribute to add "Group": "all" to LaunchPermission will fail with an AuthFailure or OperationNotPermitted error.

3. Enable Across All Active Regions

To enable the setting across all enabled regions in your AWS account at once, you can iterate over the output of describe-regions:

for region in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do
  echo "Enabling AMI Block Public Access in ${region}..."
  aws ec2 enable-image-block-public-access \
    --image-block-public-access-state block-new-sharing \
    --region "${region}"
done

4. Disable Block Public Access (If Required)

If your account needs to publish public AMIs, you can remove the block using disable-image-block-public-access:

aws ec2 disable-image-block-public-access \
  --region us-east-1

Managing the Setting with Infrastructure as Code

Terraform

In Terraform, use the aws_ec2_image_block_public_access resource to manage the account-level state declaratively:

resource "aws_ec2_image_block_public_access" "current" {
  state = "block-new-sharing"
}

AWS CloudFormation

Currently, if managing across multiple accounts and regions via CloudFormation StackSets or AWS Organizations, administrators commonly pair a declarative policy or custom resource with Service Control Policies (SCPs) to ensure consistent enforcement.

Enforcing AMI Public Sharing Restrictions Across AWS Organizations

When managing a multi-account AWS Organization, relying solely on individual account settings leaves open the possibility that an administrator in a member account could call ec2:DisableImageBlockPublicAccess. You can enforce this guard rail centrally using two complementary methods:

1. Declarative Policies for EC2

AWS Organizations supports declarative policies for EC2, which let you define and enforce the desired configuration state of EC2 attributes—including image_block_public_access—across an entire organization or specific organizational units (OUs). When enforced via a declarative policy, member accounts cannot override the state, and ManagedBy reports declarative-policy.

2. Service Control Policies (SCPs)

You can also attach an SCP that prevents principals in member accounts from disabling the AMI Block Public Access setting, as well as blocking ec2:ModifyImageAttribute requests when the ec2:Add/group condition key equals all:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDisablingAMIBlockPublicAccess",
      "Effect": "Deny",
      "Action": "ec2:DisableImageBlockPublicAccess",
      "Resource": "*"
    },
    {
      "Sid": "DenyMakingAMIsPublic",
      "Effect": "Deny",
      "Action": "ec2:ModifyImageAttribute",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:Add/group": "all"
        }
      }
    }
  ]
}

Combining the EC2 account-level Block Public Access for AMIs with organization-wide policies provides defense in depth, ensuring that machine images cannot be inadvertently exposed to the public.