AMI block public access is enabled at the account level
ec2_ami_account_block_public_access
AMI block public access configuration is assessed to see whether public sharing of AMIs is blocked in the account and Region. When enabled (block-new-sharing), no AMI in the Region can be made public regardless of individual image permissions.
Risk
Without blocking public access, AMIs could be accidentally or maliciously shared publicly, exposing baked-in secrets, source code, and infrastructure details to unauthorized actors.
prowler aws --checks ec2_ami_account_block_public_access
Recommendation
Enable AMI block public access (block-new-sharing) in every active Region. Apply guardrails (SCPs) to prevent it from being disabled, and review any AMIs that are currently shared publicly.
Remediation
aws ec2 enable-image-block-public-access --image-block-public-access-state block-new-sharing
- In the AWS console, select the target Region in the top-right.
- Go to EC2 > AMIs.
- In the AMIs page, choose Block public access for AMIs (or EC2 Dashboard > Account attributes > Data protection and security).
- Choose Manage and enable Block public access.
- Save changes.
Source Code
Resource Type
Other