A bank must produce CIS-hardened EC2 AMIs and EKS container images monthly, embed CrowdStrike and CloudWatch agents, scan for CVEs before distribution, and share only approved images to 20 workload accounts. Which pipeline should the engineer implement to secure compute workloads?
Select an answer to reveal the explanation.
Short Explanation
You need gold images that arrive hardened and scanned, not snowflakes built by hand. Your automated factory stamps each image like a mint pressing verified coins for circulation.
Full Explanation
EC2 Image Builder automates hardened AMI and container image pipelines using versioned components for CIS hardening, agent installation, and validation, integrates Amazon Inspector for CVE assessment, enforces testing before distribution, and shares only approved AMIs via RAM or ECR permissions to workload accounts with lifecycle management. Manually building instances and sharing AMIs publicly is unrepeatable, untested, insecure, and exposes images externally while missing CVE scanning and hardening enforcement. Using Run Command to patch running instances manages drift on live hosts but does not produce standardized, tested gold images or control container image provenance and distribution. Building Dockerfiles on laptops and pushing to ECR lacks centralized hardening, vulnerability gates, and reproducibility and introduces supply-chain risk. For the exam, Image Builder equals repeatable secure factory with test plus distribute phases, and in practice enforce pipeline schedules, component version pinning, and Inspector severity thresholds blocking distribution.