How to update AWS CLI tools on AWS Linux

Take a step back. The PCI scanner is blindly relying on version numbers and isn't taking into account that the vendor (which is eventually Red Hat) backports patches. Find out the exact vulnerability (get the CVE) and then use rpm -q --changelog httpd (or go to http://cve.mitre.org/cve/cve.html and https://access.redhat.com/security/updates/ ) to see if the fix has been backported. It is annoying to do; thank your lazy PCI QSA for the work.

I strongly recommend against installing from source. It breaks package management and you now become responsible for keeping apache up to date which is more annoying than verifying the backporting of fixes.

This can be achieved by using describe-images from the EC2 service in the AWS command line tools. You'll have to specify the AMI id for the --image-id argument.

From the docs:

Describes one or more of the images (AMIs, AKIs, and ARIs) available to you. Images available to you include public images, private images that you own, and private images owned by other AWS accounts but for which you have explicit launch permissions.

Note: Deregistered images are included in the returned results for an unspecified interval after deregistration.

Execute the following command:

aws ec2 describe-images \
    --image-id ami-5256b825 \
    --query "Images[*].Description[]" \
    --output text \
    --region eu-west-1

This will be the result:

amzn-ami-pv-2013.09.2.x86_64-ebs

Looking at the output, we can see that the version of the Amazon Linux AMI is 2013.09.2. Looking for this on the Amazon AMI portal, we'll be provided with this page containing the release notes of this version.