Skip to main content

AWS EC2 Hibernation Should Be Enabled

More Info:​

The Hibernation feature should be enabled for EBS-backed EC2 instances to retain memory state across instance stop/start cycles.

Risk Level​

Low

Address​

Reliability

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, I can help you with that. Here are the step-by-step instructions to remediate the AWS EC2 hibernation misconfiguration using the AWS console:

  1. Login to your AWS console and navigate to the EC2 dashboard.

  2. Select the EC2 instance for which you want to enable hibernation.

  3. Click on the 'Actions' button and select 'Instance Settings' from the dropdown.

  4. Click on the 'Enable Hibernation' option.

  5. A pop-up window will appear, click on 'Enable' to confirm the action.

  6. Once hibernation is enabled, you need to stop and start the instance to apply the changes. Click on the 'Actions' button and select 'Instance State' from the dropdown.

  7. Click on 'Stop' to stop the instance.

  8. Once the instance is stopped, click on 'Start' to start the instance again.

  9. After the instance is started, hibernation will be enabled.

That's it! You have successfully remediated the AWS EC2 hibernation misconfiguration using the AWS console.

Using CLI

To remediate the misconfiguration of AWS EC2 Hibernation not being enabled, follow these steps using AWS CLI:

  1. Open the AWS CLI on your local machine and run the following command to enable hibernation for all instances in the region:
aws ec2 modify-instance-attribute --instance-id <instance-id> --hibernation-options Configured=true

Note: Replace <instance-id> with the actual instance ID of the instance for which you want to enable hibernation.

  1. Once you have enabled hibernation for all instances in the region, you can verify the same by running the following command:
aws ec2 describe-instances --instance-ids <instance-id> --query 'Reservations[].Instances[].HibernationOptions'

Note: Replace <instance-id> with the actual instance ID of the instance for which you enabled hibernation.

  1. If the output of the above command shows that hibernation is enabled, then you have successfully remediated the misconfiguration. If not, then you can try enabling hibernation again using the first command.

  2. Repeat the above steps for all instances in the region to ensure that hibernation is enabled for all instances.

Note: Enabling hibernation may require stopping and starting the instance. Make sure to plan accordingly and schedule any necessary downtime.

Using Python

To remediate the misconfiguration in AWS EC2 Hibernation should be enabled, you can follow the below steps using Python:

  1. First, you need to install the AWS SDK for Python (Boto3) using the following command:

    pip install boto3

  2. Next, you need to create a Boto3 client for EC2 using the following code:

    import boto3

    ec2 = boto3.client('ec2')

  3. Then, you can use the describe_instances() method to get a list of all instances in your AWS account:

    instances = ec2.describe_instances()

  4. Next, you can loop through each instance and check if hibernation is enabled using the describe_instance_attribute() method:

    for instance in instances['Reservations']:
        instance_id = instance['Instances'][0]['InstanceId']
        hibernation_enabled = ec2.describe_instance_attribute(InstanceId=instance_id, Attribute='hibernation')['Hibernation']['Value']

  5. If hibernation is not enabled, you can use the modify_instance_attribute() method to enable it:

    if not hibernation_enabled:
        ec2.modify_instance_attribute(InstanceId=instance_id, HibernationOptions={'Configured': True})

  6. Finally, you can print a message indicating that hibernation has been enabled:

    print(f'Hibernation has been enabled for instance {instance_id}')

By following these steps, you can remediate the misconfiguration in AWS EC2 Hibernation should be enabled using Python.

Using Terraform
resource "aws_instance" "EBS_BACKED_INSTANCE_WITH_HIBERNATION" {
  ami           = "AMI_ID_SUPPORTING_HIBERNATION"   # e.g. Amazon Linux 2 or another supported AMI
  instance_type = "HIBERNATION_SUPPORTED_TYPE"      # e.g. t3.medium, t3.large, etc.

  # Instance must be EBS-backed; define an EBS root volume and ensure it is encrypted.
  root_block_device {
    volume_size = 50
    volume_type = "gp3"
    encrypted   = true
  }

  # Enable hibernation on the instance
  hibernation_options {
    configured = true
  }

  # ...any other arguments you already use (subnet_id, vpc_security_group_ids, etc.)...
}

Enabling hibernation_options.configured = true is an in-place change for an existing instance that already meets AWS prerequisites; changing root_block_device.encrypted from false to true will force recreation of the instance (outage) because the root volume must be rebuilt.

To verify, terraform plan should show hibernation_options.configured changing from false (or null) to true on the target aws_instance (and, if you are newly encrypting the root volume, a -/+ replacement for that instance).

Additional Reading:​