amazon-ec2-image-builder

Create a build IAM role with the EC2InstanceProfileForImageBuilder and AmazonSSMManagedInstanceCore managed policies, choose components, create an image recipe with a parent image, then run create-image with an infrastructure configuration. For one-off builds no pipeline is needed.

Create an image pipeline with a cron schedule and the EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE start condition, using a wildcard x.x.x parent image reference. Each scheduled run picks up new base-image releases, and launch template distribution rolls Auto Scaling groups onto the new AMI.

Yes. Windows uses ExecutePowerShell components and exit code 3010 for reboots, macOS requires an EC2 Mac Dedicated Host with tenancy host placement, and container images use a container recipe targeting an ECR repository with the ECR container builds managed policy on the build role.

Check image.state.reason from get-image to identify the failed stage. Component failures are only visible in the CloudWatch log group /aws/imagebuilder/<image-name>, which contains full command stdout and stderr from the build.

Pipelines only run at cron times, and the dependency-updates start condition requires update-detectable references like wildcard x.x.x versions or readable ssm: parameters. A recipe pinned to a hardcoded AMI ID never registers an update, so the pipeline skips every scheduled run.

Image Builder is not for launching instances from existing AMIs, AMI lifecycle or retirement management, or VM/ISO image import and export. Those tasks belong to general EC2 fleet management or the AWS documentation directly.