# Ensure running EC2 instances are not older than 180 days - Source: https://support.icompaas.com/support/solutions/articles/a_1793292201630319-ensure-running-ec2-instances-are-not-older-than-180-days - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no running Amazon EC2 instance has been running for more than 180 days since its last start. The age is measured from the instance's LaunchTime, which is reset each time the instance is stopped and started. Long-running instances should be regularly replaced with new instances built from up-to-date, patched images. Instances that are not running pass. **Rationale** Instances that run for a long time often have an outdated operating system, packages and agents, and drift away from the approved baseline. Attackers can exploit known vulnerabilities on these hosts to steal data, escalate privileges, tamper with the system or run malware such as crypto-miners, and aged hosts are harder to investigate and recover. Rebuilding instances regularly from hardened, updated images, combined with central patch management and vulnerability scanning, keeps workloads current and limits the impact of a compromise. **Impact** - Keeps workloads on current, patched images and reduces exposure to known vulnerabilities - Reduces configuration drift between instances - Replacing an instance can change its instance ID and IP addresses, and data on the root volume or instance store volumes is not carried over unless it is migrated - Stopping an instance interrupts the workload that runs on it **Default Value** AWS does not limit how long an EC2 instance can run. An instance keeps running until it is stopped or terminated. **Pre-Requisites** - IAM permissions: ec2:DescribeInstances, ec2:RunInstances, ec2:StopInstances and ec2:TerminateInstances - An up-to-date, patched AMI or launch template for the workload - A maintenance window agreed with the application owner, and a backup of any data stored on the instance **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Instances**. 3. Filter the list by **Instance state** = **running**. 4. Check the **Launch time** of each instance. 5. Repeat for each region in use. 6. If any running instance was launched more than 180 days ago, follow the implementation steps. **CLI:** List the running instances with their launch time: aws ec2 describe-instances --region --filters Name=instance-state-name,Values=running --query "Reservations\[\].Instances\[\].\[InstanceId,InstanceType,LaunchTime\]" --output table A running instance fails if its LaunchTime (the time of its last start) is more than 180 days ago. Instances that are not running pass. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Instances**. 3. Launch a replacement instance from an up-to-date, patched AMI or launch template, and move the workload and its data to it. 4. Select the old instance. 5. Choose **Instance state**, then **Stop instance**, and confirm with **Stop**. 6. When the replacement has been verified, terminate the old instance if it is no longer needed. 7. Repeat for each affected instance in each region in use. **CLI:** Stop the old instance once its workload has been moved to a replacement instance. Stopping an instance that still runs a workload causes an outage, so do this only after the replacement is in service: aws ec2 stop-instances --region --instance-ids **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Instances**. 3. Select the stopped instance. 4. Choose **Instance state**, then **Start instance**. 5. Move the workload back to the old instance if the replacement does not work as expected. **CLI:** aws ec2 start-instances --region --instance-ids Note: a terminated instance cannot be started again. Data on instance store volumes is lost when an instance is stopped, and the public IPv4 address changes unless an Elastic IP address is used. **Reference** - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop\_Start.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html) - [https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-patch-compliance-results.html](https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-patch-compliance-results.html) - [https://docs.aws.amazon.com/cli/latest/reference/ec2/stop-instances.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/stop-instances.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.