EC2 / Client / replace_image_criteria_in_allowed_images_settings

replace_image_criteria_in_allowed_images_settings¶

EC2.Client.replace_image_criteria_in_allowed_images_settings(**kwargs)¶

Sets or replaces the criteria for Allowed AMIs.

The ImageCriteria can include up to:

10 ImageCriterion

Note

The Allowed AMIs feature does not restrict the AMIs owned by your account. Regardless of the criteria you set, the AMIs created by your account will always be discoverable and usable by users in your account.

For more information, see Control the discovery and use of AMIs in Amazon EC2 with Allowed AMIs in Amazon EC2 User Guide.

Request Syntax

response = client.replace_image_criteria_in_allowed_images_settings(
    ImageCriteria=[
        {
            'ImageProviders': [
                'string',
            ],
            'MarketplaceProductCodes': [
                'string',
            ],
            'ImageNames': [
                'string',
            ],
            'DeprecationTimeCondition': {
                'MaximumDaysSinceDeprecated': 123
            },
            'CreationDateCondition': {
                'MaximumDaysSinceCreated': 123
            },
            'ImageWatermarks': [
                {
                    'WatermarkKey': 'string',
                    'SourceImageRegion': 'string',
                    'MaximumDaysSinceSourceImageCreated': 123,
                    'MaximumDaysSinceWatermarkCreated': 123
                },
            ],
            'ScanResultCondition': {
                'MaxDaysSinceLastFindingScan': 123,
                'MaximumSeverityLabel': 'informational'|'low'|'medium'|'high'|'critical',
                'MaxDaysSinceInformationalFixAvailable': 123,
                'MaxDaysSinceLowFixAvailable': 123,
                'MaxDaysSinceMediumFixAvailable': 123,
                'MaxDaysSinceHighFixAvailable': 123,
                'MaxDaysSinceCriticalFixAvailable': 123
            }
        },
    ],
    DryRun=True|False
)

Parameters:

ImageCriteria (list) –
The list of criteria that are evaluated to determine whether AMIs are discoverable and usable in the account in the specified Amazon Web Services Region.
- (dict) –
  
  The criteria that are evaluated to determine which AMIs are discoverable and usable in your account for the specified Amazon Web Services Region.
  
  The ImageCriteria can include up to:
  - 10 ImageCriterion
  Each ImageCriterion can include up to:
  - 200 values for ImageProviders
  - 50 values for ImageNames
  - 50 values for MarketplaceProductCodes
  - 50 values for ImageWatermarks
  For more information, see How Allowed AMIs works in the Amazon EC2 User Guide.
  - ImageProviders (list) –
    
    The image providers whose images are allowed.
    
    Possible values:
    - amazon: Allow AMIs created by Amazon or verified providers.
    - aws-marketplace: Allow AMIs created by verified providers in the Amazon Web Services Marketplace.
    - aws-backup-vault: Allow AMIs created by Amazon Web Services Backup.
    - 12-digit account ID: Allow AMIs created by the specified accounts. One or more account IDs can be specified.
    - none: Allow AMIs created by your own account only. When none is specified, no other values can be specified.
    Maximum: 200 values
    - (string) –
  - MarketplaceProductCodes (list) –
    
    The Amazon Web Services Marketplace product codes for allowed images.
    
    Length: 1-25 characters
    
    Valid characters: Letters ( A–Z, a–z) and numbers ( 0–9)
    
    Maximum: 50 values
    - (string) –
  - ImageNames (list) –
    
    The names of allowed images. Names can include wildcards ( ? and *).
    
    Length: 1–128 characters. With ?, the minimum is 3 characters.
    
    Valid characters:
    - Letters: A–Z, a–z
    - Numbers: 0–9
    - Special characters: ( ) [ ] . / - ' @ _ * ?
    - Spaces
    Maximum: 50 values
    - (string) –
  - DeprecationTimeCondition (dict) –
    
    The maximum period since deprecation for allowed images.
    - MaximumDaysSinceDeprecated (integer) –
      
      The maximum number of days that have elapsed since the image was deprecated. Set to 0 to exclude all deprecated images.
  - CreationDateCondition (dict) –
    
    The maximum age for allowed images.
    - MaximumDaysSinceCreated (integer) –
      
      The maximum number of days that have elapsed since the image was created. For example, a value of 300 allows images that were created within the last 300 days.
  - ImageWatermarks (list) –
    
    The watermark criteria that an AMI must match to be allowed. An AMI is allowed if it carries at least one watermark that satisfies an ImageWatermarkFilter. A watermark satisfies a filter when all specified fields in the ImageWatermarkFilter match the corresponding values on the watermark of the AMI.
    
    Maximum: 50 values
    - (dict) –
      
      The watermark filter criteria for an allowed image. Each entry can specify one or more fields. All specified fields must match the same watermark on the image.
      - WatermarkKey (string) –
        
        The accountId:name of the watermark. Supports wildcards ( *, ?).
      - SourceImageRegion (string) –
        
        The Region where the watermark was originally created. Supports wildcards ( *, ?).
      - MaximumDaysSinceSourceImageCreated (integer) –
        
        The maximum number of days that have elapsed since the source image was created.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
      - MaximumDaysSinceWatermarkCreated (integer) –
        
        The maximum number of days that have elapsed since the watermark was attached to the image.
        
        Constraints: Minimum value of 0. Maximum value of 2147483647.
  - ScanResultCondition (dict) –
    
    The Amazon Inspector scan-result criteria that an AMI must meet to be allowed. The criteria can limit the highest finding severity, the number of days since Amazon Inspector last scanned the AMI, and the number of days since Amazon Inspector reported a fix as available.
    - MaxDaysSinceLastFindingScan (integer) –
      
      The maximum number of days that have elapsed since Amazon Inspector last scanned the AMI. For example, a value of 7 allows AMIs that were scanned within the last 7 days. AMIs that Amazon Inspector has not scanned are not allowed.
      
      Constraints: Minimum value of 0. Maximum value of 2147483647.
    - MaximumSeverityLabel (string) –
      
      The maximum severity that an AMI’s Amazon Inspector findings can have for the AMI to be allowed. Findings count whether or not a fix is available. For example, a value of medium allows AMIs whose highest severity is informational, low, or medium.
      
      The valid values are the following Amazon Inspector severity levels, which correspond to CVSS score ranges:
      - informational - CVSS score of 0.
      - low - CVSS score of 0.1 to 3.9.
      - medium - CVSS score of 4.0 to 6.9.
      - high - CVSS score of 7.0 to 8.9.
      - critical - CVSS score of 9.0 to 10.0.
      For more information, see Software package vulnerability severity in the Amazon Inspector User Guide.
      
      A scanned AMI that has no findings meets this limit.
      
      AMIs that Amazon Inspector has not scanned are not allowed when you specify this condition.
    - MaxDaysSinceInformationalFixAvailable (integer) –
      
      The maximum number of days since Amazon Inspector reported a fix as available for an informational severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
      
      A scanned AMI that has no informational severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
      
      Constraints: Minimum value of 0. Maximum value of 2147483647.
    - MaxDaysSinceLowFixAvailable (integer) –
      
      The maximum number of days since Amazon Inspector reported a fix as available for a low severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
      
      A scanned AMI that has no low severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
      
      Constraints: Minimum value of 0. Maximum value of 2147483647.
    - MaxDaysSinceMediumFixAvailable (integer) –
      
      The maximum number of days since Amazon Inspector reported a fix as available for a medium severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
      
      A scanned AMI that has no medium severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
      
      Constraints: Minimum value of 0. Maximum value of 2147483647.
    - MaxDaysSinceHighFixAvailable (integer) –
      
      The maximum number of days since Amazon Inspector reported a fix as available for a high severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
      
      A scanned AMI that has no high severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
      
      Constraints: Minimum value of 0. Maximum value of 2147483647.
    - MaxDaysSinceCriticalFixAvailable (integer) –
      
      The maximum number of days since Amazon Inspector reported a fix as available for a critical severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.
      
      A scanned AMI that has no critical severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.
      
      Constraints: Minimum value of 0. Maximum value of 2147483647.
DryRun (boolean) – Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

Return type:

dict

Returns:

Response Syntax

{
    'ReturnValue': True|False
}

Response Structure

(dict) –
- ReturnValue (boolean) –
  
  Returns true if the request succeeds; otherwise, it returns an error.