A company requires that every EC2 instance be launched from an AMI produced by the security team. Each month the security team emails the approved AMIs to developers, who then copy them into CloudFormation templates. A DevOps engineer wants to automate distribution of the approved AMI IDs to developers in the most scalable way. Which approach is best?

The best approach is to use EC2 Image Builder to create AMIs and store their ARNs in AWS Systems Manager Parameter Store. EC2 Image Builder automates the creation, management, and deployment of secure AMIs. Parameter Store provides a centralized, scalable, and secure way to manage configuration data, including AMI ARNs. Developers can then directly reference these parameters in their CloudFormation templates using the AWS::SSM::Parameter::Value<String type, ensuring they always use the latest approved AMI without manual updates. Incorrect options: Storing ARNs in an S3 object and using cross-stack references is less direct and secure than Parameter Store, as S3 is not designed for direct parameter retrieval in CloudFormation. Using CodePipeline to write to S3 still requires an additional step for developers to retrieve and parse the S3 object, which is less integrated than Parameter Store. SNS notifications and Lambda updates introduce unnecessary complexity and latency, requiring developers to react to notifications and potentially trigger stack updates, rather than simply referencing a dynamic parameter.