Use AMI watermarks to track and identify AMIs
An AMI watermark is an identifier that you attach to your private AMIs to track provenance and enforce governance policies. Watermarks persist across the full AMI lifecycle:
-
If you create a new AMI from a running instance that was launched from a watermarked AMI, the new AMI inherits the watermark.
-
If you copy a watermarked AMI, the copy carries the watermark.
-
If you store a watermarked AMI to S3 and restore it, the restored AMI retains the watermark.
-
If you share a watermarked AMI with another account, the watermark remains visible to the recipient.
Using AMI watermarks helps you:
Key benefits
-
Track provenance across accounts and Regions — identify which AMIs derive from your approved base images.
-
Filter and find related AMIs across your accounts.
-
Help AMI consumers discover and identify trusted AMIs associated with a project or organization.
Topics
How AMI watermarks work
AMI watermarks are structured identifiers that you attach to your AMIs. The following describes the key characteristics of watermarks:
-
Persists — When you attach a watermark to an AMI, it carries forward to all derivative AMIs.
-
Owner-only — Only the AMI owner can attach watermarks to an AMI.
-
Visible to everyone — Anyone with access to the AMI can view its watermarks.
-
Limit of 5 — An AMI can have up to a total of 5 watermarks.
-
Not available on public AMIs — You can't attach watermarks to public AMIs or make AMIs public if they have a watermark.
-
Filterable — You can filter AMIs by watermark when using
describe-images.
Watermark format
A watermark is a structured object with the following fields:
-
WatermarkKey— The unique identifier for the watermark, composed ofaccount-id:watermark-name -
SourceImageRegion— The Region of the AMI to which you originally attached the watermark. -
SourceImageId— The AMI to which you originally attached the watermark. -
SourceImageCreationDate— The creation date of the AMI to which you originally attached the watermark. -
WatermarkCreationTime— The timestamp of when you applied the watermark.
The watermark name must be 3–128 characters and can contain alphanumeric characters, parentheses (()), square brackets ([]), spaces, periods (.), slashes (/), dashes (-), single quotes ('), at-signs (@), or underscores (_).
Required permissions
To work with AMI watermarks, you need the following IAM permissions:
-
ec2:AttachImageWatermark— To attach a watermark to an AMI. -
ec2:DetachImageWatermark— To detach a watermark from an AMI. -
ec2:DescribeImages— To view watermarks on AMIs.
Attach a watermark to an AMI
You can attach a watermark to an AMI by using the console, the AWS CLI, or PowerShell.
You can attach up to 5 watermarks to a single AMI.
Detach a watermark from an AMI
You can detach a watermark from an AMI by using the console, the AWS CLI, or PowerShell.
Note
Detaching a watermark from an AMI does not remove it from derivative AMIs
that already carry the watermark. To ensure watermarks remain persistent, grant the
ec2:DetachImageWatermark permission only to trusted administrators
who need to manage watermarks.
View AMI watermarks
You can view watermarks for an AMI by using the console, the AWS CLI, or PowerShell.
Filter AMIs by watermark
You can filter AMIs by watermark by using the console, the AWS CLI, or PowerShell.
