Policy for Cloud Custodian which will remove public sharing permissions for AMIs shared outside of your accounts

ami-public-remediate.yaml

policies:


- name: ami-public-remediate-realtime
  mode:
    type: cloudtrail
    events:
        - source: "ec2.amazonaws.com"
          event: "ModifyImageAttribute"
          ids: "requestParameters.imageId"
  description: |
    Detects if a AMI is made public and removes the public launch permissions and notifies Security and customer.
  resource: ami
  filters:
       - type: cross-account
         whitelist_from:
                 url: s3://your-s3-bucket/ValidAWSAccounts.csv
                 format: csv2dict
  actions:
   - remove-launch-permissions
   - type: notify
     template: default.html
     priority_header: 1
     subject: "AMI - Public Launch Permissions Removed - [custodian {{ account }} - {{ region }}]"
     violation_desc: |
          The AMI listed in the below table was granted public launch permissions which are prohibited by Risk and Compliance.
     action_desc: |
          Actions Taken - Your AMI's public launch permissions have been removed by Cloud Custodian.
     to:
        - resource-owner
        - event-owner
        - securityteam@yourcompany.com
     transport:
         type: sqs
         queue: https://sqs.us-east-1.amazonaws.com/12345678910/cloud-custodian-mailer
         region: us-east-1