What's new?

• You can now see which AMIs an EC2 instance was built from, so you can tell an instance that came from an approved base image from one built from scratch. Add ImageAncestryEntries to AWS > EC2 > Instance > CMDB > Attributes and give the Guardrails role the ec2:GetImageAncestry permission. The chain works even when the AMI belongs to another account, and each entry gives you an AMI ID you can look up. The attribute is not enabled by default, so nothing is recorded until you add it.