DOP-C02 Practice Question 43: Image Builder Golden AMI Pipeline
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 5 · question 3 of 10
A platform team builds a hardened golden AMI by hand every month: launch an instance from the latest base image, run configuration scripts, work through a manual test checklist, create the AMI, copy it to three additional Regions, and share it with 12 member accounts. They want this to run on a monthly schedule, want the image published only if an automated test suite passes on an instance launched from it, and want to write and maintain as little custom code as possible.
What should the team implement?
Show answer and explanation
Answer:
Image Builder is the managed version of this exact workflow: it "helps you to automate the creation, management, and deployment of customized, secure, and up-to-date server images," and a pipeline is configured with a schedule. Build components apply the hardening; test components run during the test stage on an instance launched from the newly created image, and Image Builder "distributes your image only if all of the configured tests have succeeded", which is the publish gate the team wants. The distribution configuration selects the Regions to copy the AMI to and supports "AMI sharing across AWS accounts and Organizations", so the copy and share steps are configuration rather than code.
Option A produces the right artifact but is the custom tooling the team is trying to avoid. Packer templates, a Lambda function for copying and sharing, its IAM role, and the glue between them all have to be written and maintained, and the test gate has to be built by hand.
Option C addresses a narrower problem. AWS-UpdateLinuxAmi applies operating system updates to an AMI; it has no test stage that can block publication, no multi-Region distribution, and no cross-account sharing.
Option D builds a different image in each Region. Four independent builds from the same base image drift from one another, there is still no test gate, and the whole thing rests on a hand-written custom resource, the opposite of "as little custom code as possible".
Reference: What is Image Builder?