EC2 / Client / get_allowed_images_settings

get_allowed_images_settings¶

EC2.Client.get_allowed_images_settings(**kwargs)¶

Gets the current state of the Allowed AMIs setting and the list of Allowed AMIs criteria at the account level in the specified Region.

Note

The Allowed AMIs feature does not restrict the AMIs owned by your account. Regardless of the criteria you set, the AMIs created by your account will always be discoverable and usable by users in your account.

For more information, see Control the discovery and use of AMIs in Amazon EC2 with Allowed AMIs in Amazon EC2 User Guide.

Request Syntax

response = client.get_allowed_images_settings(
    DryRun=True|False
)

Parameters:

DryRun (boolean) – Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

Return type:

dict

Returns:

Response Syntax

{
    'State': 'string',
    'ImageCriteria': [
        {
            'ImageProviders': [
                'string',
            ],
            'MarketplaceProductCodes': [
                'string',
            ],
            'ImageNames': [
                'string',
            ],
            'DeprecationTimeCondition': {
                'MaximumDaysSinceDeprecated': 123
            },
            'CreationDateCondition': {
                'MaximumDaysSinceCreated': 123
            },
            'ImageWatermarks': [
                {
                    'WatermarkKey': 'string',
                    'SourceImageRegion': 'string',
                    'MaximumDaysSinceSourceImageCreated': 123,
                    'MaximumDaysSinceWatermarkCreated': 123
                },
            ],
            'ScanResultCondition': {
                'MaxDaysSinceLastFindingScan': 123,
                'MaximumSeverityLabel': 'informational'|'low'|'medium'|'high'|'critical',
                'MaxDaysSinceInformationalFixAvailable': 123,
                'MaxDaysSinceLowFixAvailable': 123,
                'MaxDaysSinceMediumFixAvailable': 123,
                'MaxDaysSinceHighFixAvailable': 123,
                'MaxDaysSinceCriticalFixAvailable': 123
            }
        },
    ],
    'ManagedBy': 'account'|'declarative-policy'
}

Response Structure

(dict) –
- State (string) –
  
  The current state of the Allowed AMIs setting at the account level in the specified Amazon Web Services Region.
  
  Possible values:
  - disabled: All AMIs are allowed.
  - audit-mode: All AMIs are allowed, but the ImageAllowed field is set to true if the AMI would be allowed with the current list of criteria if allowed AMIs was enabled.
  - enabled: Only AMIs matching the image criteria are discoverable and available for use.
- ImageCriteria (list) –
  
  The list of criteria for images that are discoverable and usable in the account in the specified Amazon Web Services Region.
  - (dict) –
    
    The criteria that are evaluated to determine which AMIs are discoverable and usable in your account for the specified Amazon Web Services Region.
    
    For more information, see How Allowed AMIs works in the Amazon EC2 User Guide.
    - ImageProviders (list) –
      
      The image providers whose images are allowed.
      
      Possible values:
      - amazon: Allow AMIs created by Amazon or verified providers.
      - aws-marketplace: Allow AMIs created by verified providers in the Amazon Web Services Marketplace.
      - aws-backup-vault: Allow AMIs created by Amazon Web Services Backup.
      - 12-digit account ID: Allow AMIs created by this account. One or more account IDs can be specified.
      - none: Allow AMIs created by your own account only.
      Maximum: 200 values
      - (string) –
    - MarketplaceProductCodes (list) –
      
      The Amazon Web Services Marketplace product codes for allowed images.
      
      Length: 1-25 characters
      
      Valid characters: Letters ( A–Z, a–z) and numbers ( 0–9)
      
      Maximum: 50 values
      - (string) –
    - ImageNames (list) –
      
      The names of allowed images. Names can include wildcards ( ? and *).
      
      Length: 1–128 characters. With ?, the minimum is 3 characters.
      
      Valid characters:
      - Letters: A–Z, a–z
      - Numbers: 0–9
      - Special characters: ( ) [ ] . / - ' @ _ * ?
      - Spaces
      Maximum: 50 values
      - (string) –
    - DeprecationTimeCondition (dict) –
      
      The maximum period since deprecation for allowed images.
      - MaximumDaysSinceDeprecated (integer) –
        
        The maximum number of days that have elapsed since the image was deprecated. When set to 0, no deprecated images are allowed.
    - CreationDateCondition (dict) –
      
      The maximum age for allowed images.
      - MaximumDaysSinceCreated (integer) –
        
        The maximum number of days that have elapsed since the image was created. For example, a value of 300 allows images that were created within the last 300 days.
    - ImageWatermarks (list) –
      
      The watermark criteria that an AMI must match to be allowed. An AMI is allowed if it carries at least one watermark that satisfies an ImageWatermarkFilter. A watermark satisfies a filter when all specified fields in the ImageWatermarkFilter match the corresponding values on the watermark of the AMI.
      
      Maximum: 50 values
      - (dict) –
        
        The watermark filter criteria for an allowed image. Each entry can specify one or more fields. All specified fields must match the same watermark on the image.
        
        WatermarkKey (string) –
        
        The accountId:name of the watermark. Supports wildcards ( *, ?).
        
        SourceImageRegion (string) –
        
        The Region where the watermark was originally created. Supports wildcards ( *, ?).
        
        MaximumDaysSinceSourceImageCreated (integer) –
        
        The maximum number of days that have elapsed since the source image was created.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
        
        MaximumDaysSinceWatermarkCreated (integer) –
        
        The maximum number of days that have elapsed since the watermark was attached to the image.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
    - ScanResultCondition (dict) –
      
      The Amazon Inspector scan-result criteria that an AMI must meet to be allowed. The criteria can limit the highest finding severity, the number of days since Amazon Inspector last scanned the AMI, and the number of days since Amazon Inspector reported a fix as available.
      - MaxDaysSinceLastFindingScan (integer) –
        
        The maximum number of days that have elapsed since Amazon Inspector last scanned the AMI. For example, a value of 7 allows AMIs that were scanned within the last 7 days. AMIs that Amazon Inspector has not scanned are not allowed.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
      - MaximumSeverityLabel (string) –
        
        The maximum severity that an AMI’s Amazon Inspector findings can have for the AMI to be allowed. Findings count whether or not a fix is available. For example, a value of medium allows AMIs whose highest severity is informational, low, or medium.
        
        The valid values are the following Amazon Inspector severity levels, which correspond to CVSS score ranges:
        
        informational - CVSS score of 0.
        
        low - CVSS score of 0.1 to 3.9.
        
        medium - CVSS score of 4.0 to 6.9.
        
        high - CVSS score of 7.0 to 8.9.
        
        critical - CVSS score of 9.0 to 10.0.
        
        For more information, see Software package vulnerability severity in the Amazon Inspector User Guide.
        
        A scanned AMI that has no findings meets this limit.
        
        AMIs that Amazon Inspector has not scanned are not allowed when you specify this condition.
      - MaxDaysSinceInformationalFixAvailable (integer) –
        
        The maximum number of days since Amazon Inspector reported a fix as available for an informational severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
        
        A scanned AMI that has no informational severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
      - MaxDaysSinceLowFixAvailable (integer) –
        
        The maximum number of days since Amazon Inspector reported a fix as available for a low severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
        
        A scanned AMI that has no low severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
      - MaxDaysSinceMediumFixAvailable (integer) –
        
        The maximum number of days since Amazon Inspector reported a fix as available for a medium severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
        
        A scanned AMI that has no medium severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
      - MaxDaysSinceHighFixAvailable (integer) –
        
        The maximum number of days since Amazon Inspector reported a fix as available for a high severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
        
        A scanned AMI that has no high severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
      - MaxDaysSinceCriticalFixAvailable (integer) –
        
        The maximum number of days since Amazon Inspector reported a fix as available for a critical severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
        
        A scanned AMI that has no critical severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
- ManagedBy (string) –
  
  The entity that manages the Allowed AMIs settings. Possible values include:
  - account - The Allowed AMIs settings is managed by the account.
  - declarative-policy - The Allowed AMIs settings is managed by a declarative policy and can’t be modified by the account.