Skip to main content

EC2 Instance Should Be of Desired Type

More Info:​

EC2 instance launched should be from an approved list of instance types.

Risk Level​

Medium

Address​

Operational Maturity, Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "EC2 Instance Should Be of Desired Type" for AWS, follow these steps:

  1. Log in to your AWS Management Console.

  2. Navigate to the EC2 Dashboard.

  3. Identify the EC2 instance that is not of the desired type.

  4. Stop the instance.

  5. Select the instance and click on the "Actions" button.

  6. Click on "Instance Settings" and then click on "Change Instance Type".

  7. Select the desired instance type from the list and click on "Apply".

  8. Start the instance again.

  9. Verify that the instance type has been changed to the desired type.

Congratulations! You have successfully remediated the misconfiguration "EC2 Instance Should Be of Desired Type" for AWS using AWS console.

Using CLI

To remediate the misconfiguration "EC2 Instance Should Be of Desired Type" in AWS using AWS CLI, follow these steps:

  1. Identify the instance that is not of the desired type. You can use the following command to list all your instances:

    aws ec2 describe-instances

  2. Once you have identified the instance, stop the instance using the following command:

    aws ec2 stop-instances --instance-ids <instance-id>

    Replace <instance-id> with the ID of the instance you want to stop.

  3. After the instance has been stopped, modify its instance type using the following command:

    aws ec2 modify-instance-attribute --instance-id <instance-id> --instance-type <instance-type>

    Replace <instance-id> with the ID of the instance you want to modify and <instance-type> with the desired instance type.

  4. Start the instance using the following command:

    aws ec2 start-instances --instance-ids <instance-id>

    Replace <instance-id> with the ID of the instance you want to start.

  5. Verify that the instance is running and has the desired instance type using the following command:

    aws ec2 describe-instances --instance-ids <instance-id>

    Replace <instance-id> with the ID of the instance you want to verify.

Your EC2 instance should now be of the desired type.

Using Python

To remediate the misconfiguration of an EC2 instance type in AWS using Python, follow these steps:

  1. Import the necessary AWS SDKs and libraries in Python, such as boto3.

  2. Connect to your AWS account using the AWS SDK for Python.

  3. Retrieve the list of all EC2 instances in your account using the describe_instances method of the EC2 client.

  4. For each EC2 instance, check if the instance type matches the desired type. If it does not match, use the modify_instance_attribute method of the EC2 client to change the instance type to the desired type.

  5. Confirm that the instance type has been updated by checking the instance details using the describe_instances method.

Here is a sample Python code that can be used to remediate the misconfiguration of an EC2 instance type in AWS:

import boto3

# Connect to AWS
ec2_client = boto3.client('ec2')

# Retrieve list of all EC2 instances
instances = ec2_client.describe_instances()

# Check and update instance type for each instance
for reservation in instances['Reservations']:
    for instance in reservation['Instances']:
        instance_id = instance['InstanceId']
        current_instance_type = instance['InstanceType']
        desired_instance_type = 't2.micro' # Change this to your desired instance type
        
        if current_instance_type != desired_instance_type:
            ec2_client.modify_instance_attribute(InstanceId=instance_id, Attribute='instanceType', Value=desired_instance_type)
            print(f"Instance type updated for instance {instance_id}")
        else:
            print(f"Instance {instance_id} already has the desired instance type.")

Note that this is just a sample code and you may need to modify it based on your specific requirements. Also, make sure to test the code in a non-production environment before using it in production.

Using Terraform
resource "aws_instance" "APP_SERVER" {
  ami           = "AMI_ID"                     # replace with your AMI ID
  instance_type = "INSTANCE_TYPE_FROM_APPROVED_LIST" 
  # replace with an approved type, e.g., "t3.micro", compatible with the AMI's architecture and virtualization type

  subnet_id              = "SUBNET_ID"
  vpc_security_group_ids = ["SG_ID"]

  # ...other arguments...
}

This changes the EC2 instance type to one from your approved list; Terraform will stop and start the EBS-backed instance during apply, causing downtime but not forcing resource replacement.

terraform plan should show an in-place update of aws_instance.APP_SERVER with instance_type changing from the current value to "INSTANCE_TYPE_FROM_APPROVED_LIST".

Additional Reading:​