@aws-cdk/aws-imagebuilder-alpha 2.229.1-alpha.0 → 2.231.0-alpha.0

package/README.md

@@ -36,6 +36,457 @@ EC2 Image Builder supports AWS-managed components for common tasks, AWS Marketpl
 that you create. Components run during specific workflow phases: build and validate phases during the build stage, and
 test phase during the test stage.
 
+### Image Pipeline
+
+An image pipeline provides the automation framework for building secure AMIs and container images. The pipeline
+orchestrates the entire image creation process by combining an image recipe or container recipe with infrastructure
+configuration and distribution configuration. Pipelines can run on a schedule or be triggered manually, and they manage
+the build, test, and distribution phases automatically.
+
+#### Image Pipeline Basic Usage
+
+Create a simple AMI pipeline with just an image recipe:
+
+```ts
+const imageRecipe = new imagebuilder.ImageRecipe(this, 'MyImageRecipe', {
+  baseImage: imagebuilder.BaseImage.fromSsmParameterName(
+    '/aws/service/ami-amazon-linux-latest/al2023-ami-minimal-kernel-default-x86_64'
+  )
+});
+
+const imagePipeline = new imagebuilder.ImagePipeline(this, 'MyImagePipeline', {
+  recipe: exampleImageRecipe
+});
+```
+
+Create a simple container pipeline with just a container recipe:
+
+```ts
+const containerRecipe = new imagebuilder.ContainerRecipe(this, 'MyContainerRecipe', {
+  baseImage: imagebuilder.BaseContainerImage.fromDockerHub('amazonlinux', 'latest'),
+  targetRepository: imagebuilder.Repository.fromEcr(
+    ecr.Repository.fromRepositoryName(this, 'Repository', 'my-container-repo')
+  )
+});
+
+const containerPipeline = new imagebuilder.ImagePipeline(this, 'MyContainerPipeline', {
+  recipe: exampleContainerRecipe
+});
+```
+
+#### Image Pipeline Scheduling
+
+##### Manual Pipeline Execution
+
+Create a pipeline that runs only when manually triggered:
+
+```ts
+const manualPipeline = new imagebuilder.ImagePipeline(this, 'ManualPipeline', {
+  imagePipelineName: 'my-manual-pipeline',
+  description: 'Pipeline triggered manually for production builds',
+  recipe: exampleImageRecipe
+  // No schedule property - manual execution only
+});
+
+// Grant Lambda function permission to trigger the pipeline
+manualPipeline.grantStartExecution(lambdaRole);
+```
+
+##### Automated Pipeline Scheduling
+
+Schedule a pipeline to run automatically using cron expressions:
+
+```ts
+const weeklyPipeline = new imagebuilder.ImagePipeline(this, 'WeeklyPipeline', {
+  imagePipelineName: 'weekly-build-pipeline',
+  recipe: exampleImageRecipe,
+  schedule: {
+    expression: events.Schedule.cron({
+      minute: '0',
+      hour: '6',
+      weekDay: 'MON'
+    })
+  }
+});
+```
+
+Use rate expressions for regular intervals:
+
+```ts
+const dailyPipeline = new imagebuilder.ImagePipeline(this, 'DailyPipeline', {
+  recipe: exampleContainerRecipe,
+  schedule: {
+    expression: events.Schedule.rate(Duration.days(1))
+  }
+});
+```
+
+##### Pipeline Schedule Configuration
+
+Configure advanced scheduling options:
+
+```ts
+const advancedSchedulePipeline = new imagebuilder.ImagePipeline(this, 'AdvancedSchedulePipeline', {
+  recipe: exampleImageRecipe,
+  schedule: {
+    expression: events.Schedule.rate(Duration.days(7)),
+    // Only trigger when dependencies are updated (new base images, components, etc.)
+    startCondition: imagebuilder.ScheduleStartCondition.EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE,
+    // Automatically disable after 3 consecutive failures
+    autoDisableFailureCount: 3
+  },
+  // Start enabled
+  status: imagebuilder.ImagePipelineStatus.ENABLED
+});
+```
+
+#### Image Pipeline Configuration
+
+##### Infrastructure and Distribution in Image Pipelines
+
+Configure custom infrastructure and distribution settings:
+
+```ts
+const infrastructureConfiguration = new imagebuilder.InfrastructureConfiguration(this, 'Infrastructure', {
+  infrastructureConfigurationName: 'production-infrastructure',
+  instanceTypes: [
+    ec2.InstanceType.of(ec2.InstanceClass.COMPUTE7_INTEL, ec2.InstanceSize.LARGE)
+  ],
+  vpc: vpc,
+  subnetSelection: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }
+});
+
+const distributionConfiguration = new imagebuilder.DistributionConfiguration(this, 'Distribution');
+distributionConfiguration.addAmiDistributions({
+  amiName: 'production-ami-{{ imagebuilder:buildDate }}',
+  amiTargetAccountIds: ['123456789012', '098765432109']
+});
+
+const productionPipeline = new imagebuilder.ImagePipeline(this, 'ProductionPipeline', {
+  recipe: exampleImageRecipe,
+  infrastructureConfiguration: infrastructureConfiguration,
+  distributionConfiguration: distributionConfiguration
+});
+```
+
+##### Pipeline Logging Configuration
+
+Configure custom CloudWatch log groups for pipeline and image logs:
+
+```ts
+const pipelineLogGroup = new logs.LogGroup(this, 'PipelineLogGroup', {
+  logGroupName: '/custom/imagebuilder/pipeline/logs',
+  retention: logs.RetentionDays.ONE_MONTH
+});
+
+const imageLogGroup = new logs.LogGroup(this, 'ImageLogGroup', {
+  logGroupName: '/custom/imagebuilder/image/logs',
+  retention: logs.RetentionDays.ONE_WEEK
+});
+
+const loggedPipeline = new imagebuilder.ImagePipeline(this, 'LoggedPipeline', {
+  recipe: exampleImageRecipe,
+  imagePipelineLogGroup: pipelineLogGroup,
+  imageLogGroup: imageLogGroup
+});
+```
+
+##### Workflow Integration in Image Pipelines
+
+Use AWS-managed workflows for common pipeline phases:
+
+```ts
+const workflowPipeline = new imagebuilder.ImagePipeline(this, 'WorkflowPipeline', {
+  recipe: exampleImageRecipe,
+  workflows: [
+    { workflow: imagebuilder.AwsManagedWorkflow.buildImage(this, 'BuildWorkflow') },
+    { workflow: imagebuilder.AwsManagedWorkflow.testImage(this, 'TestWorkflow') }
+  ]
+});
+```
+
+For container pipelines, use container-specific workflows:
+
+```ts
+const containerWorkflowPipeline = new imagebuilder.ImagePipeline(this, 'ContainerWorkflowPipeline', {
+  recipe: exampleContainerRecipe,
+  workflows: [
+    { workflow: imagebuilder.AwsManagedWorkflow.buildContainer(this, 'BuildContainer') },
+    { workflow: imagebuilder.AwsManagedWorkflow.testContainer(this, 'TestContainer') },
+    { workflow: imagebuilder.AwsManagedWorkflow.distributeContainer(this, 'DistributeContainer') }
+  ]
+});
+```
+
+##### Advanced Features in Image Pipelines
+
+Configure image scanning for container pipelines:
+
+```ts
+const scanningRepository = new ecr.Repository(this, 'ScanningRepo');
+
+const scannedContainerPipeline = new imagebuilder.ImagePipeline(this, 'ScannedContainerPipeline', {
+  recipe: exampleContainerRecipe,
+  imageScanningEnabled: true,
+  imageScanningEcrRepository: scanningRepository,
+  imageScanningEcrTags: ['security-scan', 'latest']
+});
+```
+
+Control metadata collection and testing:
+
+```ts
+const controlledPipeline = new imagebuilder.ImagePipeline(this, 'ControlledPipeline', {
+  recipe: exampleImageRecipe,
+  enhancedImageMetadataEnabled: true,  // Collect detailed OS and package info
+  imageTestsEnabled: false  // Skip testing phase for faster builds
+});
+```
+
+#### Image Pipeline Events
+
+##### Pipeline Event Handling
+
+Handle specific pipeline events:
+
+```ts
+// Monitor CVE detection
+examplePipeline.onCVEDetected('CVEAlert', {
+  target: new targets.SnsTopic(topic)
+});
+
+// Handle pipeline auto-disable events
+examplePipeline.onImagePipelineAutoDisabled('PipelineDisabledAlert', {
+  target: new targets.LambdaFunction(lambdaFunction)
+});
+```
+
+#### Importing Image Pipelines
+
+Reference existing pipelines created outside CDK:
+
+```ts
+// Import by name
+const existingPipelineByName = imagebuilder.ImagePipeline.fromImagePipelineName(
+  this,
+  'ExistingPipelineByName',
+  'my-existing-pipeline'
+);
+
+// Import by ARN
+const existingPipelineByArn = imagebuilder.ImagePipeline.fromImagePipelineArn(
+  this,
+  'ExistingPipelineByArn',
+  'arn:aws:imagebuilder:us-east-1:123456789012:image-pipeline/imported-pipeline'
+);
+
+// Grant permissions to imported pipelines
+const automationRole = new iam.Role(this, 'AutomationRole', {
+  assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')
+});
+
+existingPipelineByName.grantStartExecution(automationRole);
+existingPipelineByArn.grantRead(lambdaRole);
+```
+
+### Image
+
+An image is the output resource created by Image Builder, consisting of an AMI or container image plus metadata such as
+version, platform, and creation details. Images are used as base images for future builds and can be shared across AWS
+accounts. While images are the output from image pipeline executions, they can also be created in an ad-hoc manner
+outside a pipeline, defined as a standalone resource.
+
+#### Image Basic Usage
+
+Create a simple AMI-based image from an image recipe:
+
+```ts
+const imageRecipe = new imagebuilder.ImageRecipe(this, 'MyImageRecipe', {
+  baseImage: imagebuilder.BaseImage.fromSsmParameterName(
+    '/aws/service/ami-amazon-linux-latest/al2023-ami-minimal-kernel-default-x86_64'
+  )
+});
+
+const amiImage = new imagebuilder.Image(this, 'MyAmiImage', {
+  recipe: imageRecipe
+});
+```
+
+Create a simple container image from a container recipe:
+
+```ts
+const containerRecipe = new imagebuilder.ContainerRecipe(this, 'MyContainerRecipe', {
+  baseImage: imagebuilder.BaseContainerImage.fromDockerHub('amazonlinux', 'latest'),
+  targetRepository: imagebuilder.Repository.fromEcr(
+    ecr.Repository.fromRepositoryName(this, 'Repository', 'my-container-repo')
+  )
+});
+
+const containerImage = new imagebuilder.Image(this, 'MyContainerImage', {
+  recipe: containerRecipe
+});
+```
+
+#### AWS-Managed Images
+
+##### Pre-defined OS Images
+
+Use AWS-managed images for common operating systems:
+
+```ts
+// Amazon Linux 2023 AMI for x86_64
+const amazonLinux2023Ami = imagebuilder.AmazonManagedImage.amazonLinux2023(this, 'AmazonLinux2023', {
+  imageType: imagebuilder.ImageType.AMI,
+  imageArchitecture: imagebuilder.ImageArchitecture.X86_64
+});
+
+// Ubuntu 22.04 AMI for ARM64
+const ubuntu2204Ami = imagebuilder.AmazonManagedImage.ubuntuServer2204(this, 'Ubuntu2204', {
+  imageType: imagebuilder.ImageType.AMI,
+  imageArchitecture: imagebuilder.ImageArchitecture.ARM64
+});
+
+// Windows Server 2022 Full AMI
+const windows2022Ami = imagebuilder.AmazonManagedImage.windowsServer2022Full(this, 'Windows2022', {
+  imageType: imagebuilder.ImageType.AMI,
+  imageArchitecture: imagebuilder.ImageArchitecture.X86_64
+});
+
+// Use as base image in recipe
+const managedImageRecipe = new imagebuilder.ImageRecipe(this, 'ManagedImageRecipe', {
+  baseImage: amazonLinux2023Ami.toBaseImage()
+});
+```
+
+##### Custom AWS-Managed Images
+
+Import AWS-managed images by name or attributes:
+
+```ts
+// Import by name
+const managedImageByName = imagebuilder.AmazonManagedImage.fromAmazonManagedImageName(
+  this,
+  'ManagedImageByName',
+  'amazon-linux-2023-x86'
+);
+
+// Import by attributes with specific version
+const managedImageByAttributes = imagebuilder.AmazonManagedImage.fromAmazonManagedImageAttributes(this, 'ManagedImageByAttributes', {
+  imageName: 'ubuntu-server-22-lts-x86',
+  imageVersion: '2024.11.25'
+});
+```
+
+#### Image Configuration
+
+##### Infrastructure and Distribution in Images
+
+Configure custom infrastructure and distribution settings:
+
+```ts
+const infrastructureConfiguration = new imagebuilder.InfrastructureConfiguration(this, 'Infrastructure', {
+  infrastructureConfigurationName: 'production-infrastructure',
+  instanceTypes: [
+    ec2.InstanceType.of(ec2.InstanceClass.COMPUTE7_INTEL, ec2.InstanceSize.LARGE)
+  ],
+  vpc: vpc,
+  subnetSelection: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }
+});
+
+const distributionConfiguration = new imagebuilder.DistributionConfiguration(this, 'Distribution');
+distributionConfiguration.addAmiDistributions({
+  amiName: 'production-ami-{{ imagebuilder:buildDate }}',
+  amiTargetAccountIds: ['123456789012', '098765432109']
+});
+
+const productionImage = new imagebuilder.Image(this, 'ProductionImage', {
+  recipe: exampleImageRecipe,
+  infrastructureConfiguration: infrastructureConfiguration,
+  distributionConfiguration: distributionConfiguration
+});
+```
+
+##### Logging Configuration
+
+Configure custom CloudWatch log groups for image builds:
+
+```ts
+const logGroup = new logs.LogGroup(this, 'ImageLogGroup', {
+  logGroupName: '/custom/imagebuilder/image/logs',
+  retention: logs.RetentionDays.ONE_MONTH
+});
+
+const loggedImage = new imagebuilder.Image(this, 'LoggedImage', {
+  recipe: exampleImageRecipe,
+  logGroup: logGroup
+});
+```
+
+##### Workflow Integration in Images
+
+Use workflows for custom build, test, and distribution processes:
+
+```ts
+const imageWithWorkflows = new imagebuilder.Image(this, 'ImageWithWorkflows', {
+  recipe: exampleImageRecipe,
+  workflows: [
+    { workflow: imagebuilder.AwsManagedWorkflow.buildImage(this, 'BuildWorkflow') },
+    { workflow: imagebuilder.AwsManagedWorkflow.testImage(this, 'TestWorkflow') }
+  ]
+});
+```
+
+##### Advanced Features in Images
+
+Configure image scanning, metadata collection, and testing:
+
+```ts
+const scanningRepository = new ecr.Repository(this, 'ScanningRepository');
+
+const advancedContainerImage = new imagebuilder.Image(this, 'AdvancedContainerImage', {
+  recipe: exampleContainerRecipe,
+  imageScanningEnabled: true,
+  imageScanningEcrRepository: scanningRepository,
+  imageScanningEcrTags: ['security-scan', 'latest'],
+  enhancedImageMetadataEnabled: true,
+  imageTestsEnabled: false  // Skip testing for faster builds
+});
+```
+
+#### Importing Images
+
+Reference existing images created outside CDK:
+
+```ts
+// Import by name
+const existingImageByName = imagebuilder.Image.fromImageName(
+  this,
+  'ExistingImageByName',
+  'my-existing-image'
+);
+
+// Import by ARN
+const existingImageByArn = imagebuilder.Image.fromImageArn(
+  this,
+  'ExistingImageByArn',
+  'arn:aws:imagebuilder:us-east-1:123456789012:image/imported-image/1.0.0'
+);
+
+// Import by attributes
+const existingImageByAttributes = imagebuilder.Image.fromImageAttributes(this, 'ExistingImageByAttributes', {
+  imageName: 'shared-base-image',
+  imageVersion: '2024.11.25'
+});
+
+// Grant permissions to imported images
+const role = new iam.Role(this, 'ImageAccessRole', {
+  assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')
+});
+
+existingImageByName.grantRead(role);
+existingImageByArn.grant(role, 'imagebuilder:GetImage', 'imagebuilder:ListImagePackages');
+```
+
 ### Image Recipe
 
 #### Image Recipe Basic Usage
@@ -146,7 +597,7 @@ const imageRecipe = new imagebuilder.ImageRecipe(this, 'ComponentImageRecipe', {
 Use pre-built AWS components:
 
 ```ts
-const imageRecipe = new imagebuilder.ImageRecipe(this, 'AwsManagedImageRecipe', {
+const imageRecipe = new imagebuilder.ImageRecipe(this, 'AmazonManagedImageRecipe', {
   baseImage: imagebuilder.BaseImage.fromSsmParameterName(
     '/aws/service/ami-amazon-linux-latest/al2023-ami-minimal-kernel-default-x86_64'
   ),
@@ -853,7 +1304,8 @@ containerDistributionConfiguration.addContainerDistributions({
 
 ### Workflow
 
-Workflows define the sequence of steps that Image Builder performs during image creation. There are three workflow types: BUILD (image building), TEST (testing images), and DISTRIBUTION (distributing container images).
+Workflows define the sequence of steps that Image Builder performs during image creation. There are three workflow
+types: BUILD (image building), TEST (testing images), and DISTRIBUTION (distributing container images).
 
 #### Basic Workflow Usage
 
@@ -1014,7 +1466,8 @@ const workflowFromS3 = new imagebuilder.Workflow(this, 'S3Workflow', {
 
 #### Encrypt workflow data with a KMS key
 
-You can encrypt workflow data with a KMS key, so that only principals with access to decrypt with the key are able to access the workflow data.
+You can encrypt workflow data with a KMS key, so that only principals with access to decrypt with the key are able to
+access the workflow data.
 
 ```ts
 const workflow = new imagebuilder.Workflow(this, 'EncryptedWorkflow', {
@@ -1074,3 +1527,343 @@ const testContainerWorkflow = imagebuilder.AwsManagedWorkflow.testContainer(this
 // Distribution workflows
 const distributeContainerWorkflow = imagebuilder.AwsManagedWorkflow.distributeContainer(this, 'DistributeContainer');
 ```
+
+### Lifecycle Policy
+
+Lifecycle policies help you manage the retention and cleanup of Image Builder resources automatically. These policies
+define rules for deprecating or deleting old image versions, managing AMI snapshots, and controlling resource costs by
+removing unused images based on age, count, or other criteria.
+
+#### Lifecycle Policy Basic Usage
+
+Create a lifecycle policy to automatically delete old AMI images after 30 days:
+
+```ts
+const lifecyclePolicy = new imagebuilder.LifecyclePolicy(this, 'MyLifecyclePolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { ageFilter: { age: Duration.days(30) } }
+    }
+  ],
+  resourceSelection: {
+    tags: { Environment: 'development' }
+  }
+});
+```
+
+Create a lifecycle policy to keep only the 10 most recent container images:
+
+```ts
+const containerLifecyclePolicy = new imagebuilder.LifecyclePolicy(this, 'ContainerLifecyclePolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.CONTAINER_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { countFilter: { count: 10 } }
+    }
+  ],
+  resourceSelection: {
+    tags: { Application: 'web-app' }
+  }
+});
+```
+
+#### Lifecycle Policy Resource Selection
+
+##### Tag-Based Resource Selection
+
+Apply lifecycle policies to images with specific tags:
+
+```ts
+const tagBasedPolicy = new imagebuilder.LifecyclePolicy(this, 'TagBasedPolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { ageFilter: { age: Duration.days(90) } }
+    }
+  ],
+  resourceSelection: {
+    tags: {
+      Environment: 'staging',
+      Team: 'backend'
+    }
+  }
+});
+```
+
+##### Recipe-Based Resource Selection
+
+Apply lifecycle policies to specific image or container recipes:
+
+```ts
+const imageRecipe = new imagebuilder.ImageRecipe(this, 'MyImageRecipe', {
+  baseImage: imagebuilder.BaseImage.fromSsmParameterName(
+    '/aws/service/ami-amazon-linux-latest/al2023-ami-minimal-kernel-default-x86_64'
+  )
+});
+
+const containerRecipe = new imagebuilder.ContainerRecipe(this, 'MyContainerRecipe', {
+  baseImage: imagebuilder.BaseContainerImage.fromDockerHub('amazonlinux', 'latest'),
+  targetRepository: imagebuilder.Repository.fromEcr(
+    ecr.Repository.fromRepositoryName(this, 'Repository', 'my-container-repo')
+  )
+});
+
+const recipeBasedPolicy = new imagebuilder.LifecyclePolicy(this, 'RecipeBasedPolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { countFilter: { count: 5 } }
+    }
+  ],
+  resourceSelection: {
+    recipes: [imageRecipe, containerRecipe]
+  }
+});
+```
+
+#### Lifecycle Policy Rules
+
+##### Age-Based Rules
+
+Delete images older than a specific time period:
+
+```ts
+const ageBasedPolicy = new imagebuilder.LifecyclePolicy(this, 'AgeBasedPolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  details: [
+    {
+      action: {
+        type: imagebuilder.LifecyclePolicyActionType.DELETE,
+        includeAmis: true,
+        includeSnapshots: true
+      },
+      filter: {
+        ageFilter: {
+          age: Duration.days(60),
+          retainAtLeast: 3  // Always keep at least 3 images
+        }
+      }
+    }
+  ],
+  resourceSelection: {
+    tags: { Environment: 'testing' }
+  }
+});
+```
+
+##### Count-Based Rules
+
+Keep only a specific number of the most recent images:
+
+```ts
+const countBasedPolicy = new imagebuilder.LifecyclePolicy(this, 'CountBasedPolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.CONTAINER_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { countFilter: { count: 15 } }  // Keep only the 15 most recent images
+    }
+  ],
+  resourceSelection: {
+    tags: { Application: 'microservice' }
+  }
+});
+```
+
+##### Multiple Lifecycle Rules
+
+Implement a graduated approach with multiple actions:
+
+```ts
+const graduatedPolicy = new imagebuilder.LifecyclePolicy(this, 'GraduatedPolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  details: [
+    {
+      // First: Deprecate images after 30 days
+      action: {
+        type: imagebuilder.LifecyclePolicyActionType.DEPRECATE,
+        includeAmis: true
+      },
+      filter: {
+        ageFilter: {
+          age: Duration.days(30),
+          retainAtLeast: 5
+        }
+      }
+    },
+    {
+      // Second: Disable images after 60 days  
+      action: {
+        type: imagebuilder.LifecyclePolicyActionType.DISABLE,
+        includeAmis: true
+      },
+      filter: {
+        ageFilter: {
+          age: Duration.days(60),
+          retainAtLeast: 3
+        }
+      }
+    },
+    {
+      // Finally: Delete images after 90 days
+      action: {
+        type: imagebuilder.LifecyclePolicyActionType.DELETE,
+        includeAmis: true,
+        includeSnapshots: true
+      },
+      filter: {
+        ageFilter: {
+          age: Duration.days(90),
+          retainAtLeast: 1
+        }
+      }
+    }
+  ],
+  resourceSelection: {
+    tags: { Environment: 'production' }
+  }
+});
+```
+
+#### Lifecycle Policy Exclusion Rules
+
+##### AMI Exclusion Rules
+
+Exclude specific AMIs from lifecycle actions based on various criteria:
+
+```ts
+const excludeAmisPolicy = new imagebuilder.LifecyclePolicy(this, 'ExcludeAmisPolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { ageFilter: { age: Duration.days(30) } },
+      exclusionRules: {
+        amiExclusionRules: {
+          isPublic: true,  // Exclude public AMIs
+          lastLaunched: Duration.days(7),  // Exclude AMIs launched in last 7 days
+          regions: ['us-west-2', 'eu-west-1'],  // Exclude AMIs in specific regions
+          sharedAccounts: ['123456789012'],  // Exclude AMIs shared with specific accounts
+          tags: {
+            Protected: 'true',
+            Environment: 'production'
+          }
+        }
+      }
+    }
+  ],
+  resourceSelection: {
+    tags: { Team: 'infrastructure' }
+  }
+});
+```
+
+##### Image Exclusion Rules
+
+Exclude Image Builder images with protective tags:
+
+```ts
+const excludeImagesPolicy = new imagebuilder.LifecyclePolicy(this, 'ExcludeImagesPolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.CONTAINER_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { countFilter: { count: 20 } },
+      exclusionRules: {
+        imageExclusionRules: {
+          tags: {
+            DoNotDelete: 'true',
+            Critical: 'baseline'
+          }
+        }
+      }
+    }
+  ],
+  resourceSelection: {
+    tags: { Application: 'frontend' }
+  }
+});
+```
+
+#### Advanced Lifecycle Configuration
+
+##### Custom Execution Roles
+
+Provide your own IAM execution role with specific permissions:
+
+```ts
+const executionRole = new iam.Role(this, 'LifecycleExecutionRole', {
+  assumedBy: new iam.ServicePrincipal('imagebuilder.amazonaws.com'),
+  managedPolicies: [
+    iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/EC2ImageBuilderLifecycleExecutionPolicy')
+  ]
+});
+
+const customRolePolicy = new imagebuilder.LifecyclePolicy(this, 'CustomRolePolicy', {
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  executionRole: executionRole,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { ageFilter: { age: Duration.days(45) } }
+    }
+  ],
+  resourceSelection: {
+    tags: { Environment: 'development' }
+  }
+});
+```
+
+##### Lifecycle Policy Status
+
+Control whether the lifecycle policy is active:
+
+```ts
+const disabledPolicy = new imagebuilder.LifecyclePolicy(this, 'DisabledPolicy', {
+  lifecyclePolicyName: 'my-disabled-policy',
+  description: 'A lifecycle policy that is temporarily disabled',
+  status: imagebuilder.LifecyclePolicyStatus.DISABLED,
+  resourceType: imagebuilder.LifecyclePolicyResourceType.AMI_IMAGE,
+  details: [
+    {
+      action: { type: imagebuilder.LifecyclePolicyActionType.DELETE },
+      filter: { ageFilter: { age: Duration.days(30) } }
+    }
+  ],
+  resourceSelection: {
+    tags: { Environment: 'testing' }
+  },
+  tags: {
+    Owner: 'DevOps',
+    CostCenter: 'Engineering'
+  }
+});
+```
+
+##### Importing Lifecycle Policies
+
+Reference lifecycle policies created outside CDK:
+
+```ts
+// Import by name
+const importedByName = imagebuilder.LifecyclePolicy.fromLifecyclePolicyName(
+  this,
+  'ImportedByName',
+  'existing-lifecycle-policy'
+);
+
+// Import by ARN
+const importedByArn = imagebuilder.LifecyclePolicy.fromLifecyclePolicyArn(
+  this,
+  'ImportedByArn',
+  'arn:aws:imagebuilder:us-east-1:123456789012:lifecycle-policy/my-policy'
+);
+
+importedByName.grantRead(lambdaRole);
+importedByArn.grant(lambdaRole, 'imagebuilder:UpdateLifecyclePolicy');
+```