​
More Info:

EC2 instance launched should be from an approved list of instance types.

​
Risk Level

Medium

​
Address

Operational Maturity, Reliability, Security

​
Compliance Standards

CBP

​
Remediation

​
Using Console

To remediate the misconfiguration “EC2 Instance Should Be of Desired Type” for AWS, follow these steps:

  1. Log in to your AWS Management Console.

  2. Navigate to the EC2 Dashboard.

  3. Identify the EC2 instance that is not of the desired type.

  4. Stop the instance.

  5. Select the instance and click on the “Actions” button.

  6. Click on “Instance Settings” and then click on “Change Instance Type”.

  7. Select the desired instance type from the list and click on “Apply”.

  8. Start the instance again.

  9. Verify that the instance type has been changed to the desired type.

Congratulations! You have successfully remediated the misconfiguration “EC2 Instance Should Be of Desired Type” for AWS using AWS console.

​
Using CLI

To remediate the misconfiguration “EC2 Instance Should Be of Desired Type” in AWS using AWS CLI, follow these steps:

  1. Identify the instance that is not of the desired type. You can use the following command to list all your instances:

    aws ec2 describe-instances

  2. Once you have identified the instance, stop the instance using the following command:

    aws ec2 stop-instances --instance-ids <instance-id>

    Replace <instance-id> with the ID of the instance you want to stop.

  3. After the instance has been stopped, modify its instance type using the following command:

    aws ec2 modify-instance-attribute --instance-id <instance-id> --instance-type <instance-type>

    Replace <instance-id> with the ID of the instance you want to modify and <instance-type> with the desired instance type.

  4. Start the instance using the following command:

    aws ec2 start-instances --instance-ids <instance-id>

    Replace <instance-id> with the ID of the instance you want to start.

  5. Verify that the instance is running and has the desired instance type using the following command:

    aws ec2 describe-instances --instance-ids <instance-id>

    Replace <instance-id> with the ID of the instance you want to verify.

Your EC2 instance should now be of the desired type.

​
Using Python

To remediate the misconfiguration of an EC2 instance type in AWS using Python, follow these steps:

  1. Import the necessary AWS SDKs and libraries in Python, such as boto3.

  2. Connect to your AWS account using the AWS SDK for Python.

  3. Retrieve the list of all EC2 instances in your account using the describe_instances method of the EC2 client.

  4. For each EC2 instance, check if the instance type matches the desired type. If it does not match, use the modify_instance_attribute method of the EC2 client to change the instance type to the desired type.

  5. Confirm that the instance type has been updated by checking the instance details using the describe_instances method.

Here is a sample Python code that can be used to remediate the misconfiguration of an EC2 instance type in AWS:

import boto3

# Connect to AWS
ec2_client = boto3.client('ec2')

# Retrieve list of all EC2 instances
instances = ec2_client.describe_instances()

# Check and update instance type for each instance
for reservation in instances['Reservations']:
    for instance in reservation['Instances']:
        instance_id = instance['InstanceId']
        current_instance_type = instance['InstanceType']
        desired_instance_type = 't2.micro' # Change this to your desired instance type
        
        if current_instance_type != desired_instance_type:
            ec2_client.modify_instance_attribute(InstanceId=instance_id, Attribute='instanceType', Value=desired_instance_type)
            print(f"Instance type updated for instance {instance_id}")
        else:
            print(f"Instance {instance_id} already has the desired instance type.")

Note that this is just a sample code and you may need to modify it based on your specific requirements. Also, make sure to test the code in a non-production environment before using it in production.

​
Additional Reading: