AWS Organizations管理下の各EC2インスタンスで使用されているAmazon提供以外のAMIの一覧を出してみた

{
  "ec2_attributes": {
    "allowed_images_settings": {
      "state": {
        "@@assign": "audit_mode"
      },
      "image_criteria": {
        "criteria_1": {
          "allowed_image_providers": {
            "@@assign": [
              "amazon"
            ]
          }
        }
      }
    }
  }
}

for region in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do
  echo "=== リージョン: $region ==="
  aws ec2 describe-instance-image-metadata --region $region \
    --query "InstanceImageMetadata[?ImageMetadata.ImageAllowed==\`false\`].{InstanceId:InstanceId,Name:Tags[?Key=='Name'].Value|[0],AMI:ImageMetadata.ImageId,AMI_Name:ImageMetadata.Name}" \
    --output table 2>/dev/null || echo "データなし"
  echo
done

=== リージョン: ap-northeast-3 ===

=== リージョン: ap-northeast-2 ===
データなし

=== リージョン: ap-northeast-1 ===
----------------------------------------------------------------------------------------------------------------------------------------------
|                                                        DescribeInstanceImageMetadata                                                       |
+-----------------------+------------------------------------------------------------------------------------+----------------------+--------+
|          AMI          |                                     AMI_Name                                       |     InstanceId       | Name   |
+-----------------------+------------------------------------------------------------------------------------+----------------------+--------+
|  ami-XXXXXXXXXXXX     |  openSUSE-Leap-15-6-vXXXXXXXX-hvm-ssd-x86_64-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX  |  i-XXXXXXXXXXXX      |  test  |
+-----------------------+------------------------------------------------------------------------------------+----------------------+--------+

cat > ec2-ami-rule.json << 'EOF'
{
  "OrganizationConfigRuleName": "ec2-instance-launched-with-allowed-ami",
  "OrganizationManagedRuleMetadata": {
    "Description": "Checks if running or stopped EC2 instances were launched with Amazon Machine Images (AMIs) that meet your Allowed AMIs criteria. The rule is NON_COMPLIANT if an AMI doesn't meet the Allowed AMIs criteria and the Allowed AMIs settings isn't disabled.",
    "RuleIdentifier": "EC2_INSTANCE_LAUNCHED_WITH_ALLOWED_AMI",
    "ResourceTypesScope": [
      "AWS::EC2::Instance"
    ]
  }
}
EOF
aws configservice put-organization-config-rule --cli-input-json file://ec2-ami-rule.json

#!/bin/bash

# 変数設定
AGGREGATOR_NAME="＜組織単位で有効化されているアグリゲータ名を指定＞"
CONFIG_RULE_NAME="＜AWS Config ルール名＞"

# クエリ実行
aws configservice select-aggregate-resource-config \
  --expression "SELECT configuration.targetResourceId, configuration.targetResourceType, configuration.complianceType, configuration.configRuleList, awsRegion, accountId WHERE resourceType = 'AWS::Config::ResourceCompliance' AND configuration.complianceType = 'NON_COMPLIANT'" \
  --configuration-aggregator-name $AGGREGATOR_NAME \
  --output json > all_noncompliant.json

# 特定のルールに対して非準拠のリソースだけをフィルタリング
echo "フィルタリング結果:"
cat all_noncompliant.json | jq -r '.Results[] | 
  fromjson | 
  select(.configuration.configRuleList | map(select(.configRuleName == "'$CONFIG_RULE_NAME'" and .complianceType == "NON_COMPLIANT")) | length > 0) | 
  "リソースID: " + .configuration.targetResourceId + ", リソースタイプ: " + .configuration.targetResourceType + ", アカウント: " + .accountId + ", リージョン: " + .awsRegion'

aws configservice describe-organization-config-rules --query  OrganizationConfigRules[*].OrganizationConfigRuleArn | grep 'allowed-ami'

# 以下のようにARNが表示されるので、`ec2-instance-launched-with-allowed-ami-***` の部分をAWS Config ルール名として指定
    "arn:aws:config:ap-northeast-1:***:organization-config-rule/ec2-instance-launched-with-allowed-ami-***"

フィルタリング結果:
リソースID: i-XXXXXXXXXXXX, リソースタイプ: AWS::EC2::Instance, アカウント: XXXXXXXXXXXX, リージョン: ap-northeast-1