In order to update an image, you need to follow the following steps

Updating the OS

Updates to the base OS shoudl come from one of the following sources

updates to the Azure OS

Any OS update should be triggered automatically and require no intervention

updates to the hardening code

Any updates to the Ansible role would require a checkout and merge with an incrementing version number

updates to the required tools or launch script

Any updates to the custom code would require the code to be modified and merged in with a new version number