Use a bottle rocket AMI in an AWS EC2 Image Pipeline about bottlerocket HOT 2 CLOSED

Hi @krayzie32, thanks for the issue. The short answer is no, Bottlerocket AMIs and EC2 Image builder / Image Pipeline are not compatible.

The longer answer is due to Bottlerocket's security features. Bottlerocket AMIs do not come equipped with an SSM agent running at the host level; rather, they run the SSM agent through the control container (https://github.com/bottlerocket-os/bottlerocket-control-container). Bottlerocket also ships with an immutable root filesystem, so even if the SSM agent were available at the host level, any changes attempted to the host's rootfs via SSM commands would fail.

ensure that the image complies with our security guidelines

I'd suggest you check out SECURITY_FEATURES.md and SECURITY_GUIDANCE.md to see if Bottlerocket's security posture meets the requirements for your company.

If your company evaluates security based on CIS benchmarks, Bottlerocket comes equipped with tooling to run those benchmarks via the apiclient: check out the docs here if that's relevant to you

from bottlerocket.

@ginglis13 Thank you very much for the detailed reply.

from bottlerocket.