How aws-samples/terraform-ec2-image-builder-container-hardening-pipeline works
This Terraform pattern provisions an AWS EC2 Image Builder pipeline that produces a hardened Amazon Linux 2023 container image, publishes it to ECR, and automates rebuilds after severe Inspector findings. The graph follows the README’s documented workflow and maps Terraform files to their stated responsibilities. Source excerpts were unavailable, so relationships are limited to those explicitly described in the README; individual Terraform resource references and wiring are not independently verified.
Main entry points: main.tf Terraform Configuration · recipes.tf Container Recipe · trigger-build.tf EventBridge Rules · pipeline.tf Pipeline Definition
Components 16
Infrastructure
- Terraform Configuration
main.tf - VPC Networking
infra-network-config.tf - Build Infrastructure
infr-config.tf - Image Distribution
dist-config.tf - Image Encryption
kms-key.tf - Private ECR Registry
Image Build
- Hardening Components
components.tf - Base Image
image.tf - Container Recipe
recipes.tf - Pipeline Definition
pipeline.tf - EC2 Image Builder
Security
- IAM Roles
roles.tf - Amazon Inspector
Event Automation
- EventBridge Rules
trigger-build.tf - Notification Queue
Other components
- Operator
Connections 15
- Operator → Terraform Configuration: deploys
README.md - Terraform Configuration → VPC Networking: provisions
README.md - Terraform Configuration → Build Infrastructure: provisions
README.md - Terraform Configuration → Image Distribution: provisions
README.md - Terraform Configuration → Image Encryption: provisions
README.md - Terraform Configuration → IAM Roles: provisions
README.md - Pipeline Definition → EC2 Image Builder: configures
README.md - EC2 Image Builder → Container Recipe: builds from
README.md - Container Recipe → Base Image: uses
README.md - Container Recipe → Hardening Components: includes
README.md - EC2 Image Builder → Private ECR Registry: publishes to
README.md - Amazon Inspector → Private ECR Registry: scans
README.md - EventBridge Rules → Notification Queue: notifies on publish
README.md - Amazon Inspector → EventBridge Rules: finding triggers
README.md - EventBridge Rules → EC2 Image Builder: starts pipeline
README.md