# aws-samples/terraform-ec2-image-builder-container-hardening-pipeline architecture

> Architecture diagram of the GitHub repository aws-samples/terraform-ec2-image-builder-container-hardening-pipeline, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline
- Repository: https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline

## Overview

This Terraform pattern provisions an AWS EC2 Image Builder pipeline that produces a hardened Amazon Linux 2023 container image, publishes it to ECR, and automates rebuilds after severe Inspector findings. The graph follows the README’s documented workflow and maps Terraform files to their stated responsibilities. Source excerpts were unavailable, so relationships are limited to those explicitly described in the README; individual Terraform resource references and wiring are not independently verified.

Main entry points: [`main.tf`](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/main.tf) (Terraform Configuration), [`recipes.tf`](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/recipes.tf) (Container Recipe), [`trigger-build.tf`](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/trigger-build.tf) (EventBridge Rules), [`pipeline.tf`](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/pipeline.tf) (Pipeline Definition)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_provision["Infrastructure"]
  node_terraform["Terraform Configuration<br/>[main.tf]"]
  node_network["VPC Networking"]
  node_supporting["Build Infrastructure<br/>[infr-config.tf]"]
  node_distribution["Image Distribution<br/>[dist-config.tf]"]
  node_kms["Image Encryption<br/>[kms-key.tf]"]
  node_ecr[("Private ECR Registry")]
end

subgraph group_build["Image Build"]
  node_components["Hardening Components<br/>[components.tf]"]
  node_base["Base Image<br/>[image.tf]"]
  node_recipe["Container Recipe<br/>[recipes.tf]"]
  node_pipeline["Pipeline Definition<br/>[pipeline.tf]"]
  node_imagebuilder["EC2 Image Builder"]
end

subgraph group_security["Security"]
  node_iam["IAM Roles<br/>[roles.tf]"]
  node_inspector["Amazon Inspector"]
end

subgraph group_automation["Event Automation"]
  node_events["EventBridge Rules<br/>[trigger-build.tf]"]
  node_sqs["Notification Queue"]
end

node_operator(("Operator"))

node_operator -->|"deploys"| node_terraform
node_terraform -->|"provisions"| node_network
node_terraform -->|"provisions"| node_supporting
node_terraform -->|"provisions"| node_distribution
node_terraform -->|"provisions"| node_kms
node_terraform -->|"provisions"| node_iam
node_pipeline -->|"configures"| node_imagebuilder
node_imagebuilder -->|"builds from"| node_recipe
node_recipe -->|"uses"| node_base
node_recipe -->|"includes"| node_components
node_imagebuilder -->|"publishes to"| node_ecr
node_inspector -->|"scans"| node_ecr
node_events -->|"notifies on publish"| node_sqs
node_inspector -->|"finding triggers"| node_events
node_events -->|"starts pipeline"| node_imagebuilder

click node_terraform "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/main.tf"
click node_network "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/infra-network-config.tf"
click node_supporting "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/infr-config.tf"
click node_distribution "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/dist-config.tf"
click node_kms "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/kms-key.tf"
click node_iam "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/roles.tf"
click node_components "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/components.tf"
click node_base "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/image.tf"
click node_recipe "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/recipes.tf"
click node_pipeline "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/pipeline.tf"
click node_events "https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/trigger-build.tf"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_terraform,node_network,node_supporting,node_distribution,node_kms,node_ecr toneBlue
class node_components,node_base,node_recipe,node_pipeline,node_imagebuilder toneAmber
class node_iam,node_inspector toneMint
class node_events,node_sqs toneRose
class node_operator toneIndigo
```

## Components

### Infrastructure

- [Terraform Configuration](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/main.tf): `main.tf`
- [VPC Networking](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/infra-network-config.tf): `infra-network-config.tf`
- [Build Infrastructure](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/infr-config.tf): `infr-config.tf`
- [Image Distribution](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/dist-config.tf): `dist-config.tf`
- [Image Encryption](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/kms-key.tf): `kms-key.tf`
- **Private ECR Registry**

### Image Build

- [Hardening Components](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/components.tf): `components.tf`
- [Base Image](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/image.tf): `image.tf`
- [Container Recipe](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/recipes.tf): `recipes.tf`
- [Pipeline Definition](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/pipeline.tf): `pipeline.tf`
- **EC2 Image Builder**

### Security

- [IAM Roles](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/roles.tf): `roles.tf`
- **Amazon Inspector**

### Event Automation

- [EventBridge Rules](https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/main/trigger-build.tf): `trigger-build.tf`
- **Notification Queue**

### Other components

- **Operator**

## Connections

- Operator → Terraform Configuration: deploys (evidence: `README.md`)
- Terraform Configuration → VPC Networking: provisions (evidence: `README.md`)
- Terraform Configuration → Build Infrastructure: provisions (evidence: `README.md`)
- Terraform Configuration → Image Distribution: provisions (evidence: `README.md`)
- Terraform Configuration → Image Encryption: provisions (evidence: `README.md`)
- Terraform Configuration → IAM Roles: provisions (evidence: `README.md`)
- Pipeline Definition → EC2 Image Builder: configures (evidence: `README.md`)
- EC2 Image Builder → Container Recipe: builds from (evidence: `README.md`)
- Container Recipe → Base Image: uses (evidence: `README.md`)
- Container Recipe → Hardening Components: includes (evidence: `README.md`)
- EC2 Image Builder → Private ECR Registry: publishes to (evidence: `README.md`)
- Amazon Inspector → Private ECR Registry: scans (evidence: `README.md`)
- EventBridge Rules → Notification Queue: notifies on publish (evidence: `README.md`)
- Amazon Inspector → EventBridge Rules: finding triggers (evidence: `README.md`)
- EventBridge Rules → EC2 Image Builder: starts pipeline (evidence: `README.md`)