fix: prevent hash collisions while resolving subnets, security groups and AMIs from nodeclass selectors

Author: saurav-agarwalla

pkg/controllers/nodeclass/ami.go

@@ -30,6 +30,7 @@ import (
 
 	v1 "github.com/aws/karpenter-provider-aws/pkg/apis/v1"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/amifamily"
+	amifamilytypes "github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/types"
 )
 
 type AMI struct {
@@ -47,7 +48,7 @@ func NewAMIReconciler(provider amifamily.Provider) *AMI {
 func (a *AMI) Reconcile(ctx context.Context, nodeClass *v1.EC2NodeClass) (reconcile.Result, error) {
 	amis, err := a.amiProvider.List(ctx, nodeClass)
 	if err != nil {
-		if amifamily.IsAl2DeprecationError(err) {
+		if amifamilytypes.IsAl2DeprecationError(err) {
 			nodeClass.StatusConditions().SetFalse(v1.ConditionTypeAMIsReady, "UnsupportedAlias", err.Error())
 			return reconcile.Result{}, reconcile.TerminalError(fmt.Errorf("getting amis, %w", err))
 		}
@@ -60,13 +61,13 @@ func (a *AMI) Reconcile(ctx context.Context, nodeClass *v1.EC2NodeClass) (reconc
 		// Returning 'ok' in this case means that the nodeclass will remain in an unready state until the component is restarted.
 		return reconcile.Result{RequeueAfter: time.Minute}, nil
 	}
-	if uniqueAMIs := lo.Uniq(lo.Map(amis, func(a amifamily.AMI, _ int) string {
+	if uniqueAMIs := lo.Uniq(lo.Map(amis, func(a amifamilytypes.AMI, _ int) string {
 		return a.AmiID
 	})); a.cm.HasChanged(fmt.Sprintf("amis/%s", nodeClass.Name), uniqueAMIs) {
 		log.FromContext(ctx).WithValues("ids", uniqueAMIs).V(1).Info("discovered amis")
 	}
 
-	nodeClass.Status.AMIs = lo.Map(amis, func(ami amifamily.AMI, _ int) v1.AMI {
+	nodeClass.Status.AMIs = lo.Map(amis, func(ami amifamilytypes.AMI, _ int) v1.AMI {
 		reqs := lo.Map(ami.Requirements.NodeSelectorRequirements(), func(item karpv1.NodeSelectorRequirementWithMinValues, _ int) corev1.NodeSelectorRequirement {
 			return item.NodeSelectorRequirement
 		})

pkg/controllers/nodeclass/ami_test.go

@@ -651,7 +651,7 @@ var _ = Describe("NodeClass AMI Status Controller", func() {
 			awsEnv.Clock.Step(40 * time.Minute)
 
 			// Flush Cache
-			awsEnv.EC2Cache.Flush()
+			awsEnv.AMICache.Flush()
 
 			ExpectObjectReconciled(ctx, env.Client, controller, nodeClass)
 			nodeClass = ExpectExists(ctx, env.Client, nodeClass)
@@ -750,7 +750,7 @@ var _ = Describe("NodeClass AMI Status Controller", func() {
 				},
 			})
 
-			awsEnv.EC2Cache.Flush()
+			awsEnv.AMICache.Flush()
 
 			ExpectApplied(ctx, env.Client, nodeClass)
 			ExpectObjectReconciled(ctx, env.Client, controller, nodeClass)

pkg/controllers/nodeclass/validation.go

@@ -42,6 +42,7 @@ import (
 	awserrors "github.com/aws/karpenter-provider-aws/pkg/errors"
 	"github.com/aws/karpenter-provider-aws/pkg/operator/options"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/amifamily"
+	amifamilytypes "github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/types"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/instance"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/instancetype"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/launchtemplate"
@@ -420,7 +421,7 @@ func (v *Validation) getPrioritizedInstanceTypes(ctx context.Context, nodeClass
 			{
 				Name: string(ec2types.InstanceTypeM5Large),
 				Requirements: scheduling.NewRequirements(append(
-					lo.Values(amifamily.VariantStandard.Requirements()),
+					lo.Values(amifamilytypes.VariantStandard.Requirements()),
 					scheduling.NewRequirement(corev1.LabelArchStable, corev1.NodeSelectorOpIn, karpv1.ArchitectureAmd64),
 					scheduling.NewRequirement(corev1.LabelOSStable, corev1.NodeSelectorOpExists),
 					scheduling.NewRequirement(corev1.LabelWindowsBuild, corev1.NodeSelectorOpExists),
@@ -429,7 +430,7 @@ func (v *Validation) getPrioritizedInstanceTypes(ctx context.Context, nodeClass
 			{
 				Name: string(ec2types.InstanceTypeM6gLarge),
 				Requirements: scheduling.NewRequirements(append(
-					lo.Values(amifamily.VariantStandard.Requirements()),
+					lo.Values(amifamilytypes.VariantStandard.Requirements()),
 					scheduling.NewRequirement(corev1.LabelArchStable, corev1.NodeSelectorOpIn, karpv1.ArchitectureArm64),
 					scheduling.NewRequirement(corev1.LabelOSStable, corev1.NodeSelectorOpExists),
 					scheduling.NewRequirement(corev1.LabelWindowsBuild, corev1.NodeSelectorOpExists),
@@ -483,7 +484,7 @@ func getAMICompatibleInstanceTypes(instanceTypes []*cloudprovider.InstanceType,
 			continue
 		}
 		amiRequirements := scheduling.NewNodeSelectorRequirements(ami.Requirements...)
-		if amiRequirements.IsCompatible(amifamily.VariantStandard.Requirements()) {
+		if amiRequirements.IsCompatible(amifamilytypes.VariantStandard.Requirements()) {
 			selectedInstanceTypes = append(selectedInstanceTypes, amiMap[ami.ID]...)
 		}
 	}

pkg/controllers/providers/ssm/invalidation/controller.go

@@ -28,6 +28,7 @@ import (
 
 	v1 "github.com/aws/karpenter-provider-aws/pkg/apis/v1"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/amifamily"
+	amifamilytypes "github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/types"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/ssm"
 )
 
@@ -63,7 +64,7 @@ func (c *Controller) Reconcile(ctx context.Context) (reconciler.Result, error) {
 		}
 		amiIDsToParameters[entry.Value] = entry.Parameter
 	}
-	amis := []amifamily.AMI{}
+	amis := []amifamilytypes.AMI{}
 	for _, nodeClass := range lo.Map(lo.Keys(amiIDsToParameters), func(amiID string, _ int) *v1.EC2NodeClass {
 		return &v1.EC2NodeClass{
 			Spec: v1.EC2NodeClassSpec{

pkg/fake/types.go

@@ -25,6 +25,7 @@ import (
 
 type MockedFunction[I any, O any] struct {
 	Output          AtomicPtr[O] // Output to return on call to this function
+	MultiOut        AtomicPtrSlice[O]
 	OutputPages     AtomicPtrSlice[O]
 	CalledWithInput AtomicPtrSlice[I] // Slice used to keep track of passed input to this function
 	Error           AtomicError       // Error to return a certain number of times defined by custom error options
@@ -60,6 +61,11 @@ func (m *MockedFunction[I, O]) Invoke(input *I, defaultTransformer func(*I) (*O,
 		m.successfulCalls.Add(1)
 		return m.Output.Clone(), nil
 	}
+
+	if m.MultiOut.Len() > 0 {
+		m.successfulCalls.Add(1)
+		return m.MultiOut.Pop(), nil
+	}
 	// This output pages multi-threaded handling isn't perfect
 	// It will fail if pages are asynchronously requested from the same NextToken
 	if m.OutputPages.Len() > 0 {

pkg/providers/amifamily/al2.go

@@ -32,6 +32,7 @@ import (
 	"sigs.k8s.io/karpenter/pkg/cloudprovider"
 
 	"github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/bootstrap"
+	amifamilytypes "github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/types"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/ssm"
 )
 
@@ -40,24 +41,24 @@ type AL2 struct {
 	*Options
 }
 
-func (a AL2) DescribeImageQuery(ctx context.Context, ssmProvider ssm.Provider, k8sVersion string, amiVersion string) (DescribeImageQuery, error) {
-	ids := map[string][]Variant{}
-	for path, variants := range map[string][]Variant{
+func (a AL2) DescribeImageQuery(ctx context.Context, ssmProvider ssm.Provider, k8sVersion string, amiVersion string) (amifamilytypes.DescribeImageQuery, error) {
+	ids := map[string][]amifamilytypes.Variant{}
+	for path, variants := range map[string][]amifamilytypes.Variant{
 		fmt.Sprintf("/aws/service/eks/optimized-ami/%s/amazon-linux-2/%s/image_id", k8sVersion, lo.Ternary(
 			amiVersion == v1.AliasVersionLatest,
 			"recommended",
 			fmt.Sprintf("amazon-eks-node-%s-%s", k8sVersion, amiVersion),
-		)): {VariantStandard},
+		)): {amifamilytypes.VariantStandard},
 		fmt.Sprintf("/aws/service/eks/optimized-ami/%s/amazon-linux-2-arm64/%s/image_id", k8sVersion, lo.Ternary(
 			amiVersion == v1.AliasVersionLatest,
 			"recommended",
 			fmt.Sprintf("amazon-eks-arm64-node-%s-%s", k8sVersion, amiVersion),
-		)): {VariantStandard},
+		)): {amifamilytypes.VariantStandard},
 		fmt.Sprintf("/aws/service/eks/optimized-ami/%s/amazon-linux-2-gpu/%s/image_id", k8sVersion, lo.Ternary(
 			amiVersion == v1.AliasVersionLatest,
 			"recommended",
 			fmt.Sprintf("amazon-eks-gpu-node-%s-%s", k8sVersion, amiVersion),
-		)): {VariantNeuron, VariantNvidia},
+		)): {amifamilytypes.VariantNeuron, amifamilytypes.VariantNvidia},
 	} {
 		imageID, err := ssmProvider.Get(ctx, ssm.Parameter{
 			Name:      path,
@@ -70,16 +71,16 @@ func (a AL2) DescribeImageQuery(ctx context.Context, ssmProvider ssm.Provider, k
 	}
 	// Failed to discover any AMIs, we should short circuit AMI discovery
 	if len(ids) == 0 {
-		return DescribeImageQuery{}, serrors.Wrap(fmt.Errorf("failed to discover any AMIs for alias"), "alias", fmt.Sprintf("al2@%s", amiVersion))
+		return amifamilytypes.DescribeImageQuery{}, serrors.Wrap(fmt.Errorf("failed to discover any AMIs for alias"), "alias", fmt.Sprintf("al2@%s", amiVersion))
 	}
 
-	return DescribeImageQuery{
+	return amifamilytypes.DescribeImageQuery{
 		Filters: []ec2types.Filter{{
 			Name:   lo.ToPtr("image-id"),
 			Values: lo.Keys(ids),
 		}},
-		KnownRequirements: lo.MapValues(ids, func(variants []Variant, _ string) []scheduling.Requirements {
-			return lo.Map(variants, func(v Variant, _ int) scheduling.Requirements { return v.Requirements() })
+		KnownRequirements: lo.MapValues(ids, func(variants []amifamilytypes.Variant, _ string) []scheduling.Requirements {
+			return lo.Map(variants, func(v amifamilytypes.Variant, _ int) scheduling.Requirements { return v.Requirements() })
 		}),
 	}, nil
 }

pkg/providers/amifamily/al2023.go

@@ -28,6 +28,7 @@ import (
 
 	v1 "github.com/aws/karpenter-provider-aws/pkg/apis/v1"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/bootstrap"
+	amifamilytypes "github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/types"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/ssm"
 )
 
@@ -36,11 +37,11 @@ type AL2023 struct {
 	*Options
 }
 
-func (a AL2023) DescribeImageQuery(ctx context.Context, ssmProvider ssm.Provider, k8sVersion string, amiVersion string) (DescribeImageQuery, error) {
-	ids := map[string]Variant{}
-	for arch, variants := range map[string][]Variant{
-		"x86_64": {VariantStandard, VariantNvidia, VariantNeuron},
-		"arm64":  {VariantStandard, VariantNvidia},
+func (a AL2023) DescribeImageQuery(ctx context.Context, ssmProvider ssm.Provider, k8sVersion string, amiVersion string) (amifamilytypes.DescribeImageQuery, error) {
+	ids := map[string]amifamilytypes.Variant{}
+	for arch, variants := range map[string][]amifamilytypes.Variant{
+		"x86_64": {amifamilytypes.VariantStandard, amifamilytypes.VariantNvidia, amifamilytypes.VariantNeuron},
+		"arm64":  {amifamilytypes.VariantStandard, amifamilytypes.VariantNvidia},
 	} {
 		for _, variant := range variants {
 			path := a.resolvePath(arch, string(variant), k8sVersion, amiVersion)
@@ -56,15 +57,15 @@ func (a AL2023) DescribeImageQuery(ctx context.Context, ssmProvider ssm.Provider
 	}
 	// Failed to discover any AMIs, we should short circuit AMI discovery
 	if len(ids) == 0 {
-		return DescribeImageQuery{}, serrors.Wrap(fmt.Errorf("failed to discover any AMIs for alias"), "alias", fmt.Sprintf("al2023@%s", amiVersion))
+		return amifamilytypes.DescribeImageQuery{}, serrors.Wrap(fmt.Errorf("failed to discover any AMIs for alias"), "alias", fmt.Sprintf("al2023@%s", amiVersion))
 	}
 
-	return DescribeImageQuery{
+	return amifamilytypes.DescribeImageQuery{
 		Filters: []ec2types.Filter{{
 			Name:   lo.ToPtr("image-id"),
 			Values: lo.Keys(ids),
 		}},
-		KnownRequirements: lo.MapValues(ids, func(v Variant, _ string) []scheduling.Requirements {
+		KnownRequirements: lo.MapValues(ids, func(v amifamilytypes.Variant, _ string) []scheduling.Requirements {
 			return []scheduling.Requirements{v.Requirements()}
 		}),
 	}, nil

pkg/providers/amifamily/ami.go

@@ -24,15 +24,17 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
-	"github.com/mitchellh/hashstructure/v2"
+	"github.com/awslabs/operatorpkg/object"
 	"github.com/patrickmn/go-cache"
 	"github.com/samber/lo"
 	"k8s.io/utils/clock"
 
 	"github.com/aws/karpenter-provider-aws/pkg/errors"
+	"github.com/aws/karpenter-provider-aws/pkg/utils"
 
 	v1 "github.com/aws/karpenter-provider-aws/pkg/apis/v1"
 	sdk "github.com/aws/karpenter-provider-aws/pkg/aws"
+	amifamilytypes "github.com/aws/karpenter-provider-aws/pkg/providers/amifamily/types"
 	"github.com/aws/karpenter-provider-aws/pkg/providers/version"
 
 	"sigs.k8s.io/controller-runtime/pkg/log"
@@ -43,7 +45,7 @@ import (
 )
 
 type Provider interface {
-	List(ctx context.Context, nodeClass *v1.EC2NodeClass) (AMIs, error)
+	List(ctx context.Context, nodeClass *v1.EC2NodeClass) (amifamilytypes.AMIs, error)
 }
 
 type DefaultProvider struct {
@@ -67,7 +69,7 @@ func NewDefaultProvider(clk clock.Clock, versionProvider version.Provider, ssmPr
 }
 
 // List Returning a list of AMIs with its associated requirements
-func (p *DefaultProvider) List(ctx context.Context, nodeClass *v1.EC2NodeClass) (AMIs, error) {
+func (p *DefaultProvider) List(ctx context.Context, nodeClass *v1.EC2NodeClass) (amifamilytypes.AMIs, error) {
 	p.Lock()
 	defer p.Unlock()
 	queries, err := p.DescribeImageQueries(ctx, nodeClass)
@@ -83,28 +85,26 @@ func (p *DefaultProvider) List(ctx context.Context, nodeClass *v1.EC2NodeClass)
 }
 
 //nolint:gocyclo
-func (p *DefaultProvider) DescribeImageQueries(ctx context.Context, nodeClass *v1.EC2NodeClass) ([]DescribeImageQuery, error) {
+func (p *DefaultProvider) DescribeImageQueries(ctx context.Context, nodeClass *v1.EC2NodeClass) ([]amifamilytypes.DescribeImageQuery, error) {
 	// Aliases are mutually exclusive, both on the term level and field level within a term.
 	// This is enforced by a CEL validation, we will treat this as an invariant.
 	if alias := nodeClass.Alias(); alias != nil {
 		kubernetesVersion := p.versionProvider.Get(ctx)
 		if alias.Family == v1.AMIFamilyAL2 {
 			minorVersion, err := strconv.Atoi(strings.Split(kubernetesVersion, ".")[1])
 			if err == nil && minorVersion >= 33 {
-				return nil, &AL2DeprecationError{
-					error: fmt.Errorf("AL2 aliases are no longer supported on EKS 1.33+ (see https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions-standard.html#kubernetes-1-33)"),
-				}
+				return nil, amifamilytypes.NewAL2DeprecationError("AL2 aliases are no longer supported on EKS 1.33+ (see https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions-standard.html#kubernetes-1-33)")
 			}
 		}
 		query, err := GetAMIFamily(alias.Family, nil).DescribeImageQuery(ctx, p.ssmProvider, kubernetesVersion, alias.Version)
 		if err != nil {
-			return []DescribeImageQuery{}, err
+			return []amifamilytypes.DescribeImageQuery{}, err
 		}
-		return []DescribeImageQuery{query}, nil
+		return []amifamilytypes.DescribeImageQuery{query}, nil
 	}
 
 	idFilter := ec2types.Filter{Name: aws.String("image-id")}
-	queries := []DescribeImageQuery{}
+	queries := []amifamilytypes.DescribeImageQuery{}
 	for _, term := range nodeClass.Spec.AMISelectorTerms {
 		switch {
 		case term.ID != "":
@@ -116,7 +116,7 @@ func (p *DefaultProvider) DescribeImageQueries(ctx context.Context, nodeClass *v
 			})
 			if err != nil {
 				if !errors.IsNotFound(err) {
-					return []DescribeImageQuery{}, fmt.Errorf("resolving ssm parameter, %w", err)
+					return []amifamilytypes.DescribeImageQuery{}, fmt.Errorf("resolving ssm parameter, %w", err)
 				}
 				log.FromContext(ctx).WithValues("ssmParameter", term.SSMParameter).V(1).Error(err, "parameter not found")
 				continue
@@ -127,13 +127,13 @@ func (p *DefaultProvider) DescribeImageQueries(ctx context.Context, nodeClass *v
 			}
 			idFilter.Values = append(idFilter.Values, imageID)
 		default:
-			query := DescribeImageQuery{
+			query := amifamilytypes.DescribeImageQuery{
 				Owners: lo.Ternary(term.Owner != "", []string{term.Owner}, []string{}),
 			}
 			if term.Name != "" {
 				// Default owners to self,amazon to ensure Karpenter only discovers cross-account AMIs if the user specifically allows it.
 				// Removing this default would cause Karpenter to discover publicly shared AMIs passing the name filter.
-				query = DescribeImageQuery{
+				query = amifamilytypes.DescribeImageQuery{
 					Owners: lo.Ternary(term.Owner != "", []string{term.Owner}, []string{"self", "amazon"}),
 				}
 				query.Filters = append(query.Filters, ec2types.Filter{
@@ -159,23 +159,22 @@ func (p *DefaultProvider) DescribeImageQueries(ctx context.Context, nodeClass *v
 		}
 	}
 	if len(idFilter.Values) > 0 {
-		queries = append(queries, DescribeImageQuery{Filters: []ec2types.Filter{idFilter}})
+		queries = append(queries, amifamilytypes.DescribeImageQuery{Filters: []ec2types.Filter{idFilter}})
 	}
 	return queries, nil
 }
 
 //nolint:gocyclo
-func (p *DefaultProvider) amis(ctx context.Context, queries []DescribeImageQuery) (AMIs, error) {
-	hash, err := hashstructure.Hash(queries, hashstructure.FormatV2, &hashstructure.HashOptions{SlicesAsSets: true})
-	if err != nil {
-		return nil, err
-	}
-	if images, ok := p.cache.Get(fmt.Sprintf("%d", hash)); ok {
+func (p *DefaultProvider) amis(ctx context.Context, queries []amifamilytypes.DescribeImageQuery) (amifamilytypes.AMIs, error) {
+	// Sort queries for a consistent hash.
+	utils.SortQueries(queries)
+	hash := object.Hash(queries)
+	if images, ok := p.cache.Get(hash); ok {
 		// Ensure what's returned from this function is a deep-copy of AMIs so alterations
 		// to the data don't affect the original
-		return append(AMIs{}, images.(AMIs)...), nil
+		return append(amifamilytypes.AMIs{}, images.(amifamilytypes.AMIs)...), nil
 	}
-	images := map[uint64]AMI{}
+	images := map[string]amifamilytypes.AMI{}
 	for _, query := range queries {
 		paginator := ec2.NewDescribeImagesPaginator(p.ec2api, query.DescribeImagesInput())
 		for paginator.HasMorePages() {
@@ -195,9 +194,11 @@ func (p *DefaultProvider) amis(ctx context.Context, queries []DescribeImageQuery
 					// Following checks are needed in order to always priortize non deprecated AMIs
 					// If we already have an image with the same set of requirements, but this image (candidate) is newer, replace the previous (existing) image.
 					// If we already have an image with the same set of requirements which is deprecated, but this image (candidate) is newer or non deprecated, replace the previous (existing) image
-					reqsHash := lo.Must(hashstructure.Hash(reqs.NodeSelectorRequirements(), hashstructure.FormatV2, &hashstructure.HashOptions{SlicesAsSets: true}))
-					candidateDeprecated := parseTimeWithDefault(lo.FromPtr(image.DeprecationTime), maxTime).Unix() <= p.clk.Now().Unix()
-					ami := AMI{
+					// Sort requirements to get a consistent hash.
+					utils.SortRequirements(reqs.NodeSelectorRequirements())
+					reqsHash := object.Hash(reqs.NodeSelectorRequirements())
+					candidateDeprecated := amifamilytypes.ParseTimeWithDefault(lo.FromPtr(image.DeprecationTime), amifamilytypes.MaxTime).Unix() <= p.clk.Now().Unix()
+					ami := amifamilytypes.AMI{
 						Name:         lo.FromPtr(image.Name),
 						AmiID:        lo.FromPtr(image.ImageId),
 						CreationDate: lo.FromPtr(image.CreationDate),
@@ -214,7 +215,7 @@ func (p *DefaultProvider) amis(ctx context.Context, queries []DescribeImageQuery
 			}
 		}
 	}
-	p.cache.SetDefault(fmt.Sprintf("%d", hash), AMIs(lo.Values(images)))
+	p.cache.SetDefault(hash, amifamilytypes.AMIs(lo.Values(images)))
 	return lo.Values(images), nil
 }
 
@@ -242,9 +243,9 @@ func MapToInstanceTypes(instanceTypes []*cloudprovider.InstanceType, amis []v1.A
 // 0 if AMI i == AMI j, where creation date, deprecation status and name are all equal
 // -1 if AMI i < AMI j, if AMI i is non-deprecated or newer than AMI j
 // +1 if AMI i > AMI j, if AMI j is non-deprecated or newer than AMI i
-func compareAMI(i, j AMI) int {
-	iCreationDate := parseTimeWithDefault(i.CreationDate, minTime)
-	jCreationDate := parseTimeWithDefault(j.CreationDate, minTime)
+func compareAMI(i, j amifamilytypes.AMI) int {
+	iCreationDate := amifamilytypes.ParseTimeWithDefault(i.CreationDate, amifamilytypes.MinTime)
+	jCreationDate := amifamilytypes.ParseTimeWithDefault(j.CreationDate, amifamilytypes.MinTime)
 	// Prioritize non-deprecated AMIs over deprecated ones
 	if i.Deprecated != j.Deprecated {
 		return lo.Ternary(i.Deprecated, 1, -1)