Service Graph unable to fetch some Images via data source "SG-AWS-Image-Private" OR "SG-AWS-Image-Id

[shalaka_v]

HI, I came across an issue where the "Operating System" field is empty for many Servers. This field is populated via "SGC-AWS-EC2" data source.

"SGC-AWS-EC2" makes use of the "Guest OS" Field ( this is present on the OS image record- cmdb_ci_os_template) to populate the "operating system" field on the server record. But for the servers which have this os field empty, we are not able to fetch their image details via SGC. The image details are fetched via two data sources "SG-AWS-Image-Private" and "SG-AWS-Image-Id".

Does anyone have any idea why this might be happening? We already have the “ ec2:DescrbeImages “ IAM role to the user.

Any inputs are much appreciated.

[Vikram Reddy]

Hi @shalaka_v,

First thing to check: whether those AMIs are actually owned by the account SGC is scanned with. SG-AWS-Image-Private only returns images owned by your account (Owners=self); SG-AWS-Image-Id is the fallback lookup by specific ImageId for everything else.

• AMI ownership: Marketplace, community, or cross-account shared AMIs never hit the Private query.
• Deregistered AMIs: if the image was deregistered after launch (common with ASG golden images), the Id lookup returns nothing.
• Region scope: DescribeImages is per region, confirm the image's region is included in the SG-AWS account/region config.
• IAM policy spelling: verify the action reads exactly ec2:DescribeImages, a typo there fails silently instead of throwing an auth error.

Thank you,
Vikram Karety
Octigo Solutions INC

[shalaka_v]

Thanks @Vikram Reddy . This is helpful. I will check in with my Cloud team to get these details