# Ensure EC2 Desired Instance Tenancy Setting Check

- Source: https://support.icompaas.com/support/solutions/articles/62000228285-ensure-ec2-desired-instance-tenancy-setting-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

Amazon Elastic Compute Cloud (Amazon EC2) provides scalable computing capacity in the Amazon Web Services (AWS) cloud. Tenancy defines how EC2 instances are distributed across physical hardware and affects pricing.

### **Rationale:**

When you configure instance tenancy, you can choose how EC2 instances are distributed across physical hardware. There are three tenancy options available: 

1.  Shared (default) — Multiple AWS accounts may share the same physical hardware. 
    
2.  Dedicated Instance (dedicated) — Your instance runs on single-tenant hardware.
    
3.  Dedicated Host (host) — Your instance runs on a physical server with EC2 instance capacity fully dedicated to your use, an isolated server with configurations that you can control.
    

You can configure tenancy for EC2 instances using a launch configuration or launch template. However, the host tenancy value cannot be used with a launch configuration. Use the default or dedicated tenancy values only.

**Impact**:

Using the right tenancy model for your Amazon EC2 instances should reduce the concerns around security at the instance hypervisor level and promote better compliance.

### **Default:**

By default, the instance tenancy setting is set to shared, i.e., multiple AWS accounts may share the same physical hardware.

**Pre-requisites:**

N/A

## **Remediation:**

## **Test Plan:**

#### Using AWS Console:

1.  Sign into the AWS Management Console
    
2.  Navigate to the AWS Config [https://console.aws.amazon.com/ec2](https://console.aws.amazon.com/ec2 "https://console.aws.amazon.com/ec2")
    
3.  In the navigation panel, under **Instances**, choose **Instances**. ![](https://support.icompaas.com/assets/kb/c27f403bc46685aa.png) 
    
4.   Select the Amazon EC2 instance that you want to examine.
    
5.  Choose the **Details** tab from the console bottom panel to access the instance configuration details.![](https://support.icompaas.com/assets/kb/c7960000cfd2bae6.png)
    
6.  In the **Host and placement group** section, check the **Tenancy** configuration attribute value to determine the instance tenancy type. If the attribute value is set to **default**, the selected Amazon EC2 instance is running on Multi-Tenant Hardware (logically isolated). If the **Tenancy** attribute value is set to **dedicated**, the selected EC2 instance is running on Single-Tenant Hardware (physically isolated at the host hardware level).  ![](https://support.icompaas.com/assets/kb/01f50bfd4ccc4d9d.png)  
    

  

#### Using AWS CLI:

1.  Run **describe-instances** command (OSX/Linux/UNIX) with custom query filters to list the IDs of the Amazon EC2 instances available in the selected AWS cloud region:
    
    aws ec2 describe-instances  
      --region <value>  
      --output table  
      --query 'Reservations\[\*\].Instances\[\*\].InstanceId'
    
2.  The command output should return a table with the requested instance identifiers (IDs).
3.  Run **describe-instances** command (OSX/Linux/UNIX) using the ID of the Amazon EC2 instance that you want to examine as the identifier parameter and custom filtering to describe the type of tenancy used by the selected EC2 instance:    
4.  aws ec2 describe-instances  
      --region <value>  
      --instance-ids <instance-id>  
      --query 'Reservations\[\*\].Instances\[\*\].Placement.Tenancy\[\]'
    
      
    
5.  The command output should return the type of the tenancy configured for the selected Amazon EC2 instance:
    
    1.  **default**  — Multiple AWS accounts may share the same physical hardware. 
        
    2.  **dedicated**  — Your instance runs on single-tenant hardware.
        
    3.  **host** — Your instance runs on a physical server with EC2 instance capacity fully dedicated to your use, an isolated server with configurations that you can control.
        

### **Implementation steps:**

**Using AWS Console:**

1.  Sign into the AWS Management Console.
    
2.  Navigate to Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/").
    
3.  In the navigation panel, under **Instances**, choose **Instances**.
    
4.  Select the Amazon EC2 instance that you want to re-create. ![](https://support.icompaas.com/assets/kb/026b22f0f1c02cd8.png) 
    
5.  Click on the **Actions** dropdown menu from the console top menu, select **Image and templates**, and choose **Create image**. ![](https://support.icompaas.com/assets/kb/af7f1051a9028b03.png) 
    
6.  On the **Create image** setup page, provide the following information: ![](https://support.icompaas.com/assets/kb/2cfe4d94b3eac756.png) 
7.  In the **Image name** box, enter a unique name for the new AMI.
    
8.  Deselect **Enable** under **No reboot** so that Amazon EC2 service can guarantee the file system integrity for the new AMI. ![](https://support.icompaas.com/assets/kb/a051fcf3891c7124.png) 
    
9.  Choose **Create image** to create your new AMI.
10.  Once the new image is ready, use it to relaunch your Amazon EC2 instance with the correct tenancy type. On the **Instances** listing page, choose **Launch instances**and perform the following operations: 
     1.  For **Step 1: Choose an Amazon Machine Image (AMI)**, choose **My AMIs** tab, and select the Amazon Machine Image (AMI) created at step no. 6. ![](https://support.icompaas.com/assets/kb/f19c5f5b88d0c53a.png) 
         
     2.  For **Step 2: Choose an Instance Type**, select the required instance type (must match the instance type used by the source instance). Choose **Next: Configure Instance Details** to continue the setup process.
     3.  For **Step 3: Configure Instance Details**, perform the following actions:
     4.  From the **Tenancy** dropdown list, select one of the following tenancy types based on your requirements: ![](https://support.icompaas.com/assets/kb/ae93eb7b67ebecfd.png) 
         1.  **Shared: Run a shared hardware instance** – to deploy the instance in a logically isolated hardware environment (Shared Instance). This is the default tenancy type used by most EC2 instances deployed in the AWS cloud.
             
         2.  **Dedicated: Run a Dedicated instance** – to deploy the instance in a physically isolated hardware environment (Dedicated Instance). This type of tenancy is used by a subset of instances that have special needs when it comes to security and compliance requirements.
             
         3.  **Dedicated host: Launch this instance on a Dedicated host** – to deploy the instance in a physically isolated hardware environment (Dedicated Host). An EC2 Dedicated Host gives you the same level of isolation as a Dedicated Instance but provides additional visibility and control over how instances are placed on the physical machine so you can consistently deploy your instances to the same physical environment over time.
             
         4.  Configure the network, identity management, behavior, and metadata settings. The new instance configuration must match the source instance configuration. Choose **Next: Add Storage** to continue the setup process.
             
     5.  For **Step 4: Add Storage**, configure the storage device settings. Choose **Next: Add Tags** to set up the instance tags.
         
     6.  For **Step 5: Add Tags**, use the **Add tag** button to create and apply user-defined tags to the new EC2 instance. You can track compute cost and other criteria by tagging your instance. Choose **Configure Security Group** to continue the setup process.
         
     7.  For **Step 6: Configure Security Group**, choose **Select an existing security group** and select the security group(s) associated with the source Amazon EC2 instance. Choose **Review and Launch** to continue.
         
     8.  For **Step 7: Review Instance Launch**, review your EC2 instance configuration details, then choose **Launch**.
         
     9.  In the **Select an existing key pair or create a new key pair** configuration box, select **Choose an existing key pair** and use the same key pair as the source instance. Select the **I acknowledge that I have access to the selected private key file (<key-name>.pem), and that without this file, I won't be able to log into my instance** checkbox for confirmation, then choose **Launch Instances** to launch your new Amazon EC2 instance.
         
     10.  Choose **View Instances** to return to the **Instances** page.
          
11.  Repeat steps no. 4 – 10 for each Amazon EC2 instance that you want to re-create, available within the current AWS region.

  

### **Using AWS CLI:**

1.  Run **create-image** command (OSX/Linux/UNIX) to create an image from the source Amazon EC2 instance described at the previous step. Include the **\--no-reboot** command parameter to guarantee the file system integrity for your new AMI:
    
    aws ec2 create-image
      --region us-east-1
      --instance-id i-01234abcd1234abcd
      --name "Project5 EC2 Instance AMI"
      --description "Production Stack AMI ver. 1.8"
      --no-reboot
    
2.  The command output should return the ID of the new Amazon Machine Image (AMI): 
    
    {
      "ImageId": "ami-0abcdabcdabcdabcd"
    }
    
3.  Execute **run-instances** command (OSX/Linux/UNIX) to launch a new Amazon EC2 instance from the AMI created at the previous steps. Use the information returned at step no. 2 for the instance configuration parameters. Set the **\--placement** parameter to **Tenancy=default** to use the Default Tenancy model (logically isolated hardware environment), **Tenancy=dedicated** to use the Dedicated Tenancy model (physically isolated hardware environment), and **Tenancy=host** to use the Host Tenancy model (physically isolated hardware environment that provides full control over the instance placement at the host level): 
    
    aws ec2 run-instances
      --region us-east-1
      --image-id <image-id>
      --count 1
      --instance-type <instance-type>
      --key-name conformity
      --security-group-ids <security-group>
      --iam-instance-profile Name="ec2-manager-role"
      --placement Tenancy=<default | dedicated | host>
    
4.  Verify the changes using the Test Plan mentioned above.

### **Backout Plan:**

Follow the implementation steps mentioned above to change the instance tenancy from default (shared) to dedicated or vice-versa.

Note: Not all EC2 instance types are eligible for the dedicated tenancy model. To verify if your instance type can be launched in a dedicated hardware environment, consult the official AWS documentation at [https://aws.amazon.com/ec2/purchasing-options/dedicated-instances/](https://aws.amazon.com/ec2/purchasing-options/dedicated-instances/ "https://aws.amazon.com/ec2/purchasing-options/dedicated-instances/")

You can change the default tenancy of a virtual private cloud (VPC) from default (shared) to dedicated host.  
  
**References**:

[![](https://support.icompaas.com/assets/kb/6175ff94c0d38301.png)desired-instance-tenancy - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/desired-instance-tenancy.html) 

[![](https://support.icompaas.com/assets/kb/e7f360c7a03ee0dd.png)Configure instance tenancy with a launch configuration - Amazon EC2 Auto Scaling](https://docs.aws.amazon.com/autoscaling/ec2/userguide/auto-scaling-dedicated-instances.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.