A SaaS company builds 40 golden AMIs and 25 container images monthly across three Regions. Images must start from CIS-hardened baselines, install CrowdStrike and CloudWatch agent, pass vulnerability scans, and distribute only approved versions. Which hardened image approach should the platform team implement to secure compute workloads?

The correct approach creates EC2 Image Builder pipelines with AWS and custom hardening components for CIS baselines plus required agents, adds Inspector test components to fail noncompliant builds, versions recipes and enforces distribution settings so only approved AMIs and container images replicate to target Regions and accounts. Manual instance customization with snapshot AMIs and broad sharing lacks repeatability, version control, automated testing and governance, so it fails the hardened-at-scale and approved-only requirements. Scanning production with Inspector and patching live with Run Command improves hygiene but does not produce hardened golden images or gate distribution before deployment. Pulling untested public images from S3 Dockerfiles into production bypasses hardening, provenance and vulnerability gates entirely. For the exam, remember Image Builder handles both AMIs and container images with build, test and distribute phases integrated with Inspector, and practically enforce pipeline schedules, component version pinning and launch-template references to approved image versions.