1. Log in to your AWS Management Console.
2. Go to the EC2 Dashboard.
3. Click on the “AMIs” option from the left-hand navigation panel.
4. Identify the AMI which has exceeded the configured age.
5. Select the AMI and click on the “Actions” button.
6. Choose the “Deregister” option from the drop-down list.
7. Confirm the deregistration by clicking on the “Deregister” button in the confirmation dialog box.
8. Once the AMI is deregistered, you can create a new AMI with the latest updates and configurations.

​

1. First, identify the AMIs that have exceeded the configured age by running the below command:
   aws ec2 describe-images --owners self --query 'Images[?CreationDate<=`<configured_age>`].[ImageId,CreationDate]' --output text
   
   Note: Replace <configured_age> with the age limit in the format yyyy-mm-dd.
2. Once you have identified the AMIs, you can deregister them using the below command:
   aws ec2 deregister-image --image-id <image_id>
   
   Note: Replace <image_id> with the ID of the AMI that you want to deregister.
3. Finally, to automate this process, you can create a Lambda function that runs the above commands on a scheduled basis to ensure that AMIs do not exceed the configured age limit.

1. Identify the misconfigured AMIs by checking their age against the configured age.
2. Create a Lambda function in AWS that uses the Boto3 library to identify the misconfigured AMIs.
3. Use the EC2 client in Boto3 to get a list of all the AMIs in your AWS account.
4. Loop through the list of AMIs and check the age of each one against the configured age.
5. If an AMI is older than the configured age, deregister it using the EC2 client.
6. Set up a CloudWatch event to trigger the Lambda function at a regular interval to ensure that all misconfigured AMIs are remediated in a timely manner.

import boto3
from datetime import datetime, timedelta

# Set the configured age of AMIs in days
configured_age = 30

# Create an EC2 client
ec2 = boto3.client('ec2')

# Get a list of all the AMIs in the account
response = ec2.describe_images(Owners=['self'])

# Loop through the list of AMIs and check their age
for image in response['Images']:
    creation_date = datetime.strptime(image['CreationDate'], '%Y-%m-%dT%H:%M:%S.%fZ')
    age_in_days = (datetime.now() - creation_date).days
    if age_in_days > configured_age:
        # Deregister the AMI
        ec2.deregister_image(ImageId=image['ImageId'])

# Terraform cannot change the age of an existing AMI; you must use a newer AMI
# (≤ 180 days old) and update any EC2 resources to point to it. This forces
# replacement of those EC2 resources.

# Example: look up a recent Amazon Linux 2 AMI (you must ensure it is ≤ 180 days old
# when you apply, e.g. by checking the publish date in the console/docs).
data "aws_ami" "RECENT_AMAZON_LINUX2" {
  most_recent = true

  owners = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

# Example of an EC2 instance that previously used an old, non-compliant AMI ID.
# Point it to the newer AMI (or to a new aws_ami you build yourself).
resource "aws_instance" "EC2_INSTANCE_NEEDS_NEW_AMI" {
  ami           = data.aws_ami.RECENT_AMAZON_LINUX2.id
  instance_type = "INSTANCE_TYPE"

  subnet_id              = "SUBNET_ID"
  vpc_security_group_ids = ["SECURITY_GROUP_ID"]
  key_name               = "KEY_PAIR_NAME"

  tags = {
    Name = "INSTANCE_NAME"
  }
}

• Replace INSTANCE_TYPE, SUBNET_ID, SECURITY_GROUP_ID, KEY_PAIR_NAME, and INSTANCE_NAME with your values.
• Ensure the AMI resolved by data.aws_ami.RECENT_AMAZON_LINUX2 is not older than 180 days when you apply (check in the AWS Console or aws ec2 describe-images).
• This change will force replacement of aws_instance.EC2_INSTANCE_NEEDS_NEW_AMI (and similarly any launch templates/ASGs you update), causing instance recreation/outage unless you use a rolling deployment strategy.