creating-ec2-image-builder-pipeline

Create the resources in order: IAM role and instance profile, build component, image recipe, infrastructure configuration, distribution configuration, then the image pipeline itself. Use the exact ARNs returned by each create call, and start the build with start-image-pipeline-execution.

Create a distribution configuration containing one distribution entry per target region, each with an amiDistributionConfiguration naming template. Attach it to the image pipeline so every successful build copies the AMI to those regions automatically.

This error is almost always caused by a malformed or manually constructed ARN. Always pass the exact ARN returned by the create API calls, in the format arn:<partition>:imagebuilder:<region>:<account>:image-pipeline/<name> with no extra version or build segments.

The instance profile usually has not propagated yet or is missing policies. Wait 10-15 seconds after creating the instance profile, and confirm EC2InstanceProfileForImageBuilder and AmazonSSMManagedInstanceCore are attached to the role.

Image builds typically take 15-45 minutes and continue running in the background after execution starts. Check progress with aws imagebuilder get-image using the image build version ARN until the status reaches AVAILABLE.

Yes, when the enable_ecr_builds option is set to true, the procedure attaches the EC2InstanceProfileForImageBuilderECRContainerBuilds managed policy to the IAM role. When false, that policy is deliberately not attached to avoid unnecessary ECR access.