c3.12 Build a golden-image pipeline
Automate the creation of hardened "golden images" from the latest patched OS, with your required agents pre-installed, and enforce that only approved images are used. EC2 Image Builder makes this repeatable at no additional cost.
Implementation guidance
What a golden-image pipeline produces
Automate a pipeline that builds the base images used to deploy your applications: 1. Start from the latest OS version with all patches applied. 2. Apply configuration hardening per your policies (for example CIS benchmarks). 3. Pre-install required agents — anti-malware, file-integrity monitoring, and especially the AWS Systems Manager (SSM) agent. Note that many AWS AMIs (Amazon Linux, Windows) ship with the SSM agent preinstalled.
Build with EC2 Image Builder
EC2 Image Builder automates building, hardening, testing, and distributing images. Third-party options such as HashiCorp Packer also work. Enforce that only approved images run by using AWS Config rules approved-amis-by-id or approved-amis-by-tag.
How to validate
- Have you implemented a golden-image pipeline?
- Is it widely adopted across the organization?
- Are you enforcing that only approved images are used (for example via AWS Config)?
Threats addressed
- Without a golden-image pipeline, OS hardening drifts and unpatched OS or middleware persists, letting an adversary exploit a public-facing application for initial access.
AWS services
EC2 Image Builder 
AWS Config 
AWS Systems Manager Pricing
EC2 Image Builder is free — you pay only for the resources used to build and store the images. See EC2 Image Builder pricing.