In AWS, permission to use a private Amazon Machine Image (AMI) is tightly controlled and restricted by default to the account that created it. However, private AMIs can be shared with specific accounts or make them public, which can expose sensitive data. To control the discovery and use of AMIs we can use the allowed AMIs feature, which specifies criteria that AMIs must meet to be visible available within the account.