A watermark for your AMIs? EC2 AMI Watermarks reveals every image's origin!

Hi everyone, it's me, Shii-chan! Today Amazon EC2 shipped a quiet-but-handy feature, so let me walk you through it.

AWS What's New aws.amazon.com

What was announced?

Over on AWS What's New, Amazon EC2 introduced AMI Watermarks. It lets you embed your own custom identifier (a watermark) into a private AMI so you can track and govern where that image came from. It's available at no additional cost in all AWS Regions, including AWS China and AWS GovCloud (US).

The story so far

Until now, once you copied an AMI, or built a fresh AMI from a running instance, it was tough to answer "wait, which approved image did this actually derive from?" The bigger your organization got, the more mystery AMIs piled up and the fuzzier governance became.

What changes

Once you set a watermark, it automatically carries forward to every AMI derived from the original. Copy it, or build a new one from a running instance, and the watermark tags along. It even survives crossing Regions and accounts, so you can tell at a glance, "yes, this is one of our approved images!"

Dive Deep

A watermark holds metadata like the AMI ID, owner ID, Region, and creation timestamps. Combine it with Allowed AMIs to restrict instance launches to approved images, and use Declarative Policies to enforce it at scale.

You can manage it from the AWS Management Console, AWS CLI, and SDKs, and it integrates with EC2 Image Builder. If you want the full details, check out the documentation.

Wrap-up

• A new feature that embeds a watermark into an AMI so you can track and govern its origin
• The watermark carries forward to copies and derived AMIs, and survives across Regions and accounts
• Pair it with Allowed AMIs or Declarative Policies to keep launches to approved images only
• No additional cost, available in all Regions

This is a welcome update for larger teams juggling lots of AMIs, or anyone who wants tight governance!