amazon-ec2-image-builder
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- IAM and Role Management: The skill provides detailed instructions for creating IAM roles and instance profiles necessary for image builds. It correctly utilizes AWS managed policies like
EC2InstanceProfileForImageBuilderandAmazonSSMManagedInstanceCoreto follow the principle of least privilege. Additionally, it includesaws:SourceAccountconditions in trust policies to mitigate confused-deputy vulnerabilities. - Secure Component Development: The instructions for creating custom build components use the standard
ExecuteBashaction. The skill explicitly warns against embedding sensitive data (API keys, passwords, etc.) in component definitions, instead directing the agent to use AWS Secrets Manager or SSM Parameter Store, which is a key security best practice. - Infrastructure Hardening: The skill includes guardrails to enforce a secure posture, such as requiring IMDSv2 on build instances (
httpTokens=required), recommending the use of encrypted S3 buckets with Block Public Access for build logs, and suggesting the association of customer-managed KMS keys with CloudWatch log groups. - Agent Operational Guardrails: The skill defines clear boundaries for the AI agent regarding file access, distinguishing between the skill's own packaged references (potentially accessed via platform-specific tools) and user-provided data. This prevents improper data handling and ensures standard filesystem tools are used for user artifacts.
Audit Metadata