AMI bake pipelines for a public-health account ship images that later show critical CVEs in Amazon Inspector. Which vulnerability-response improvement should be prioritized?
Select an answer to reveal the explanation.
Short Explanation
Shipping an AMI full of critical CVEs is like opening a clinic with the fire exits chained. Let Inspector scan the golden image and fail the pipeline when the red findings are still hot. Fix first, promote second.
Full Explanation
AMI bake pipelines for a public-health account that ship images later flagged with critical CVEs in Amazon Inspector need a release gate, not optional backlog theater. Gating AMI releases on Inspector or equivalent findings so images with unresolved critical CVEs cannot promote until remediated stops vulnerable goldens from reaching production fleets. That vulnerability-response improvement works because immutable infrastructure multiplies whatever is baked—scanning before promote contains blast radius. Disabling Inspector to keep velocity high and patching only annually fails by institutionalizing known vulnerability windows. Promoting every AMI to production first and opening Inspector findings as optional backlog stories fails conceptually: production should not be the scanner’s first environment. Publishing unscanned AMIs to all OUs through RAM without a findings review fails by distributing risk org-wide. Exam caveat: define severity thresholds and exception process for risk-accepted findings with expiry; a hard gate with no exception path can freeze emergency patches—govern exceptions tightly. Operational check: add Inspector scan to the AMI pipeline, fail promotion on critical findings, rebuild a remediated AMI, confirm the gate passes, and block RAM sharing of unscanned images.