Hardening AWS EC2 Instances

Question

I have launched and AWS ECS cluster with 4 EC2 instances with ecs optimized AMI 2 years ago, the system was working fine but due to systems hardening compliance , I need to update my ECS cluster EC2 instances with latest ECS optimized AMI.

I can take latest AMI and update the instances but how can I automate this process continously, lets say for every 3 months, My autoscaling group should update the instances with latest ECS optimized AMI release by amazon.

My EC2 instances are in autoscaling group, what automation ideas I can implement here.

any AWS doc or github repo link to achieve this also will be very helpful.

Thanks in Advance

Answer 1

Step 1: You can use latest ami ids from AWS System Manager's paramstore and set up notifications when it is changed using EventBridge Step 2: Write a lamba to update your launch config which has ami ids