# Deregister an Amazon EC2 AMI Deregister an AMI When you deregister an AMI, Amazon EC2 permanently deletes it. After you deregister an AMI, you can't use it to launch new instances. You might consider deregistering an AMI when you have finished using it. To protect against accidental or malicious deregistering of an AMI, you can turn on [deregistration protection](ami-deregistration-protection.md). If you accidentally deregister an EBS-backed AMI, you can use the [Recycle Bin](https://docs.aws.amazon.com/ebs/latest/userguide/recycle-bin.html) to restore it only if you restore it within the allowed time period before it is permanently deleted. When deregistering an AMI, you can optionally delete its associated snapshots at the same time. However, if a snapshot is associated with multiple AMIs, it won't be deleted even if specified for deletion, although the AMI will still be deregistered. Any snapshots not deleted will continue to incur storage costs. Deregistering an AMI has no effect on any instances that were launched from the AMI. You can continue to use these instances. By default, deregistering an AMI also has no effect on any snapshots that were created during the AMI creation process. You'll continue to incur usage costs for these instances and storage costs for the snapshots. Therefore, to avoid incurring unnecessary costs, we recommend that you terminate any instances and delete any snapshots that you do not need. You can delete the snapshots either automatically during deregistration or manually after deregistration. For more information, see [Avoid costs from unused resources](#delete-unneeded-resources-to-avoid-unnecessary-costs). For instances launched from an AMI that is subsequently deregistered, you can still view some high-level information about the AMI by using the `describe-instance-image-metadata` AWS CLI command. For more information, see [describe-instance-image-metadata](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instance-image-metadata.html). **Topics** + [ ## Considerations ](#deregister-ami-considerations) + [ ## Deregister an AMI ](#deregister-an-ami) + [ ## Avoid costs from unused resources ](#delete-unneeded-resources-to-avoid-unnecessary-costs) + [ # Protect an Amazon EC2 AMI from deregistration ](ami-deregistration-protection.md) ## Considerations + You can't deregister an AMI that is not owned by your account. + You can't use Amazon EC2 to deregister an AMI that is managed by the AWS Backup service. Instead, use AWS Backup to delete the corresponding recovery points in the backup vault. For more information, see [Deleting backups](https://docs.aws.amazon.com/aws-backup/latest/devguide/deleting-backups.html) in the *AWS Backup Developer Guide*. ## Deregister an AMI You can deregister EBS-backed AMIs and Amazon S3-backed AMIs. For EBS-backed AMIs, you can optionally delete the associated snapshots at the same time. However, if a snapshot is associated with other AMIs, it will not be deleted even if specified for deletion. ------ #### [ Console ] **To deregister an AMI** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, choose **AMIs**. 1. From the filter bar, choose **Owned by me** to list your available AMIs, or choose **Disabled images** to list your disabled AMIs. 1. Select the AMI to deregister. 1. Choose **Actions**, **Deregister AMI**. 1. (Optional) To delete the associated snapshots during deregistration, select the **Delete associated snapshots** checkbox. **Note** If a snapshot is associated with other AMIs, it is not deleted, even if the checkbox is selected. 1. Choose **Deregister AMI**. It might take a few minutes before the console removes the AMI from the list. Choose **Refresh** to refresh the status. ------ #### [ AWS CLI ] **To deregister an AMI** Use the following [deregister-image](https://docs.aws.amazon.com/cli/latest/reference/ec2/deregister-image.html) command. ``` aws ec2 deregister-image --image-id ami-0abcdef1234567890 ``` **To deregister an AMI and delete its associated snapshots** Use the following [deregister-image](https://docs.aws.amazon.com/cli/latest/reference/ec2/deregister-image.html) command and specify the `--delete-associated-snapshots` parameter. Note that if a snapshot is associated with other AMIs, it is not deleted, even if you specify this parameter. ``` aws ec2 deregister-image \ --image-id ami-0abcdef1234567890 \ --delete-associated-snapshots ``` ------ #### [ PowerShell ] **To deregister an AMI** Use the [Unregister-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Unregister-EC2Image.html) cmdlet. ``` Unregister-EC2Image -ImageId ami-0abcdef1234567890 ``` **To deregister an AMI and delete its associated snapshots** Use the [Unregister-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Unregister-EC2Image.html) cmdlet and specify the `-DeleteAssociatedSnapshots` parameter. Note that if a snapshot is associated with other AMIs, it is not deleted, even if you specify this parameter. ``` Unregister-EC2Image ` -ImageId ami-0abcdef1234567890 ` -DeleteAssociatedSnapshots ``` ------ ## Avoid costs from unused resources Deregistering an AMI doesn't, by default, delete all of the resources that are associated with the AMI. These resources include the snapshots for EBS-backed AMIs and the files in Amazon S3 for Amazon S3-backed AMIs. When you deregister an AMI, you also don't terminate or stop any instances launched from the AMI. You will continue to incur costs for storing the snapshots and files, and you will incur costs for any running instances. To avoid incurring these types of unnecessary costs, we recommend deleting any resources that you don't need. **EBS-backed AMIs** + Delete the associated snapshots while deregistering the AMI. For more information, see [Deregister an AMI](#deregister-an-ami). + If you deregister an AMI without deleting its associated snaphots, you can manually [delete the snapshots](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-deleting-snapshot.html#ebs-delete-snapshot). The snapshot of the instance root volume created during AMI creation has the following description format: ``` Created by CreateImage(i-1234567890abcdef0) for ami-0abcdef1234567890 ``` + If you no longer need the instances that were launched from the AMI, you can [stop](Stop_Start.md#starting-stopping-instances) or [terminate](terminating-instances.md#terminating-instances-console) them. To list the instances, filter by the ID of the AMI. **Amazon S3-backed AMIs** + Delete the bundle in Amazon S3 by using the [ec2-delete-bundle](ami-tools-commands.md#ami-delete-bundle) (AMI tools) command. + If the Amazon S3 bucket is empty after you delete the bundle, and you have no further use for that bucket, you can [delete the bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-bucket.html). + If you no longer need the instances that were launched from the AMI, you can [terminate](terminating-instances.md#terminating-instances-console) them. To list the instances, filter by the ID of the AMI. # Protect an Amazon EC2 AMI from deregistration Protect an AMI from deregistration You can turn on *deregistration protection* on an AMI to prevent accidental or malicious deletion. When you turn on deregistration protection, the AMI can’t be deregistered by any user, regardless of their IAM permissions. If you want to deregister the AMI, you must first turn off the deregistration protection on it. When you turn on deregistration protection on an AMI, you have the option to include a 24-hour cooldown period. This cooldown period is the time during which deregistration protection remains in effect after you turn it off. During this cooldown period, the AMI can’t be deregistered. When the cooldown period ends, the AMI can be deregistered. Deregistration protection is turned off by default on all existing and new AMIs. ## Turn on deregistration protection Use the following procedures to turn on deregistration protection. ------ #### [ Console ] **To turn on deregistration protection** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, choose **AMIs**. 1. From the filter bar, choose **Owned by me** to list your available AMIs, or choose **Disabled images** to list your disabled AMIs. 1. Select the AMI on which you want to turn on deregistration protection, and then choose **Actions**, **Manage AMI deregistration protection**. 1. In the **Manage AMI deregistration protection** dialog box, you can turn on deregistration protection with or without a cooldown period. Choose one of the following options: + **Enable with a 24-hour cooldown period** – With a cooldown period, the AMI can’t be deregistered for 24 hours when deregistration protection is turned off. + **Enable without cooldown** – Without a cooldown period, the AMI can be deregistered immediately when deregistration protection is turned off. 1. Choose **Save**. ------ #### [ AWS CLI ] **To turn on deregistration protection** Use the [enable-image-deregistration-protection](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-image-deregistration-protection.html) command. To enable the optional cooldown period, include the `--with-cooldown` option. ``` aws ec2 enable-image-deregistration-protection \ --image-id ami-0abcdef1234567890 \ --with-cooldown ``` ------ #### [ PowerShell ] **To turn on deregistration protection** Use the [Enable-EC2ImageDeregistrationProtection](https://docs.aws.amazon.com/powershell/latest/reference/items/Enable-EC2ImageDeregistrationProtection.html) cmdlet. To enable the optional cooldown period, set the `-WithCooldown` parameter to `true`. ``` Enable-EC2ImageDeregistrationProtection ` -ImageId ami-0abcdef1234567890 ` -WithCooldown $true ``` ------ ## Turn off deregistration protection Use the following procedures to turn off deregistration protection. If you chose to include a 24-hour cooldown period when you turned on deregistration protection for the AMI, then, when you turn off deregistration protection, you won’t immediately be able to deregister the AMI. The cooldown period is the 24-hour time period during which deregistration protection remains in effect even after you turn it off. During this cooldown period, the AMI can’t be deregistered. After the cooldown period ends, the AMI can be deregistered. ------ #### [ Console ] **To turn off deregistration protection** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, choose **AMIs**. 1. From the filter bar, choose **Owned by me** to list your available AMIs, or choose **Disabled images** to list your disabled AMIs. 1. Select the AMI to turn off deregistration protection, and then choose **Actions**, **Manage AMI deregistration protection**. 1. In the **Manage AMI deregistration protection** dialog box, choose **Disable**. 1. Choose **Save**. ------ #### [ AWS CLI ] **To turn off deregistration protection** Use the [disable-image-deregistration-protection](https://docs.aws.amazon.com/cli/latest/reference/ec2/disable-image-deregistration-protection.html) command. ``` aws ec2 disable-image-deregistration-protection --image-id ami-0abcdef1234567890 ``` ------ #### [ PowerShell ] **To turn off deregistration protection** Use the [Disable-EC2ImageDeregistrationProtection](https://docs.aws.amazon.com/powershell/latest/reference/items/Disable-EC2ImageDeregistrationProtection.html) cmdlet. ``` Disable-EC2ImageDeregistrationProtection -ImageId ami-0abcdef1234567890 ``` ------