Description

Ensure that no running Amazon EC2 instance has been running for more than 180 days since its last start. The age is measured from the instance's LaunchTime, which is reset each time the instance is stopped and started. Long-running instances should be regularly replaced with new instances built from up-to-date, patched images. Instances that are not running pass.

Rationale

Instances that run for a long time often have an outdated operating system, packages and agents, and drift away from the approved baseline. Attackers can exploit known vulnerabilities on these hosts to steal data, escalate privileges, tamper with the system or run malware such as crypto-miners, and aged hosts are harder to investigate and recover. Rebuilding instances regularly from hardened, updated images, combined with central patch management and vulnerability scanning, keeps workloads current and limits the impact of a compromise.

Impact

  • Keeps workloads on current, patched images and reduces exposure to known vulnerabilities

  • Reduces configuration drift between instances

  • Replacing an instance can change its instance ID and IP addresses, and data on the root volume or instance store volumes is not carried over unless it is migrated

  • Stopping an instance interrupts the workload that runs on it

Default Value

AWS does not limit how long an EC2 instance can run. An instance keeps running until it is stopped or terminated.

Pre-Requisites

  • IAM permissions: ec2:DescribeInstances, ec2:RunInstances, ec2:StopInstances and ec2:TerminateInstances

  • An up-to-date, patched AMI or launch template for the workload

  • A maintenance window agreed with the application owner, and a backup of any data stored on the instance

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Instances.

  3. Filter the list by Instance state = running.

  4. Check the Launch time of each instance.

  5. Repeat for each region in use.

  6. If any running instance was launched more than 180 days ago, follow the implementation steps.

CLI:

List the running instances with their launch time:

aws ec2 describe-instances --region <REGION> --filters Name=instance-state-name,Values=running --query "Reservations[].Instances[].[InstanceId,InstanceType,LaunchTime]" --output table

A running instance fails if its LaunchTime (the time of its last start) is more than 180 days ago. Instances that are not running pass.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Instances.

  3. Launch a replacement instance from an up-to-date, patched AMI or launch template, and move the workload and its data to it.

  4. Select the old instance.

  5. Choose Instance state, then Stop instance, and confirm with Stop.

  6. When the replacement has been verified, terminate the old instance if it is no longer needed.

  7. Repeat for each affected instance in each region in use.

CLI:

Stop the old instance once its workload has been moved to a replacement instance. Stopping an instance that still runs a workload causes an outage, so do this only after the replacement is in service:

aws ec2 stop-instances --region <REGION> --instance-ids <INSTANCE_ID>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Instances.

  3. Select the stopped instance.

  4. Choose Instance state, then Start instance.

  5. Move the workload back to the old instance if the replacement does not work as expected.

CLI:

aws ec2 start-instances --region <REGION> --instance-ids <INSTANCE_ID>

Note: a terminated instance cannot be started again. Data on instance store volumes is lost when an instance is stopped, and the public IPv4 address changes unless an Elastic IP address is used.

Reference