Panther high experimental python

AWS AMI Sharing

This policy ensures that AMIs you have created are not configured to allow public access, which could result in accidental data loss. AMI's that you use but do not own are not evaluated by this policy.

View Source

Detection Logic

# Add owners as desired
APPROVED_OWNERS = [
    "amazon",
    "microsoft",
]


def policy(resource):
    # These are trusted public snapshot distributors, allow
    if resource["ImageOwnerAlias"] in APPROVED_OWNERS:
        return True

    # Ignore AMIs that are not owned by the scanned account
    if resource["AccountId"] != resource["OwnerId"]:
        return True

    return not resource["Public"]

Field Validations

Loading…

Comments (0)

Loading comments...