Identifying root cause of audit failures when updating AMI product visibility

Question

I am attempting to resolve an audit error when requesting to change the product visibility from limited to public on an AMI product. The rule that's giving the audit failure is "AWS resource access: Products must not request AWS access or secret keys from users." I do understand what that is saying. We have removed the previous access mechanism and replaced it with using the instance ID (obtained from IMDSv2) to enable logins on the AMI's UI. This appears to be common practice. We have also removed all mentions of access keys from the product documentation and detailed how to use the instance ID for logins.

Are there any ways to drill in on what specifically is causing an audit failure like this? The security scans for the AMI all appear to be passing, so if the problem is in documentation it would be really helpful to be able to identify what is triggering the rule.

Taka · Answer

Using the "Test 'Add Version'" feature in the Marketplace Management Portal

Official AWS documentation strongly recommends performing a preliminary check using the "Test 'Add Version'" feature before submitting a product. Since this is a standard automated validation process, it may not provide the specific reasons behind a manual audit failure like the one experienced here; however, it can at least offer more detailed feedback regarding automated policy checks.

[Add a new version - AWS Marketplace](https://docs.aws.amazon.com/marketplace/latest/developerguide/ml-add-version.html)

re:Post Agent · Answer

When you submit a change request to update your AMI product visibility from Limited to Public in AWS Marketplace, the submission goes through a review process that includes automated audits and manual reviews. The audit rule you're encountering - "AWS resource access: Products must not request AWS access or secret keys from users" - is designed to ensure products don't ask buyers to share their AWS credentials.

Unfortunately, the AWS Marketplace audit system doesn't provide granular feedback about exactly which element triggered a specific rule failure. However, here are the key areas to investigate:

**Documentation Review:**
Even though you've updated your product documentation, carefully review ALL documentation fields including:
- Product description
- Usage instructions
- Installation guides
- Configuration steps
- Any supplementary documentation or links
- Screenshots or images that might contain old references

Look for any legacy language that might reference "access keys," "secret keys," "AWS credentials," or similar terms, even if used in a different context.

**AMI Configuration:**
While your security scans are passing, review:
- Any startup scripts or user data templates
- Configuration files baked into the AMI
- Sample configuration files or templates
- Any prompts or UI elements in the software itself that might ask for credentials

**Best Practice:**
Since you've already made the changes to use instance ID from IMDSv2 (which is indeed a common and recommended practice), ensure your documentation explicitly states that users should NOT provide AWS access keys and clearly explains the instance ID-based authentication method.

If you continue to experience issues after thoroughly reviewing these areas, you can add correspondence to your existing change request through the AWS Marketplace Management Portal to ask for clarification on what specifically triggered the audit failure. The review team may be able to provide additional guidance to help you identify the specific element causing the issue.  
**Sources**  
[Updating AMI-based product visibility - AWS Marketplace](https://docs.aws.amazon.com/marketplace/latest/userguide/ami-update-visibility.html)

Identifying root cause of audit failures when updating AMI product visibility

Add your answer

Relevant content