Use AMI ancestry to trace the origin of an AMI

Key benefits

Using AMI ancestry helps you:

• Track AMI derivatives to ensure compliance with internal policies.

• Identify potentially vulnerable AMIs when a security issue is found in an ancestor AMI.

• Maintain visibility of AMI origins across multiple Regions.

• Each AMI displays the ID and Region of its source (parent) AMI.

• Starting with your selected AMI, the list of ancestry entries displays each parent AMI in sequence.

• The list of ancestry entries traces back until it reaches the root AMI. The root AMI is one of the following:

  • A public AMI from a verified provider (identified by its owner alias, which is either amazon or aws-marketplace).

  • An AMI with no recorded ancestor. For example, when using RegisterImage to create an AMI directly from a set of snapshots, there is no source AMI to track, unlike when creating an AMI from an instance.

  • An AMI whose source AMI is from a different partition.

  • The 50th AMI in the list. The maximum number of AMIs in an ancestry list is 50.

• The ID and Region of the source AMI are only available for AMIs created using CreateImage, CopyImage, or CreateRestoreImageTask.

• For AMIs created using CreateImage (creates an AMI from an instance), the source AMI ID is the ID of the AMI used to launch the instance.

• The source AMI information is not available for:

  • AMIs created using RegisterImage because they were created from snapshots.

  • For some older AMIs.

• The source AMI information is preserved when:

  • AMIs are copied across Regions.

  • Source AMIs are deregistered (deleted).

  • You don’t have access to the source AMIs.

• Each ancestry list is limited to 50 AMIs.