AMI Build

Machine images for the example service are built on a fixed schedule from a base operating system image, hardened, and published to an internal image registry for use across environments. Each build applies the latest security patches and bakes in the agents required for monitoring and log shipping.

The build pipeline is defined declaratively. A simplified excerpt of the build configuration looks like this:

yaml image: name: example-app-base base: example-os:2026.1 region: <region> steps: - install-security-updates - install-monitoring-agent - bake-application-runtime publish: accounts: - <account-id> regions: - <region>

Images are versioned and retained for a limited window so that a rollback to a previous image is always possible during a deployment issue.