StopInstances - AWS Ec2 Threat Event

Event Information

The StopInstances event in AWS for EC2 refers to the action of stopping an EC2 instance.
When this event occurs, it means that the EC2 instance has been intentionally halted and is no longer running.
Stopping an instance is different from terminating it, as stopping allows you to restart the instance later, while termination permanently deletes the instance and its associated resources.

Examples

Unauthorized access: If the StopInstances action is not properly restricted, it can be executed by unauthorized users or entities, leading to potential security breaches.
Data loss or corruption: Stopping an EC2 instance abruptly can result in data loss or corruption if the instance is not properly shut down or if any pending writes are not completed.
Service disruption: Stopping an EC2 instance can cause service disruption if it is hosting critical applications or services, leading to potential impact on availability and business operations.

Remediation

Using Console

Example 1: Unauthorized Access to AWS EC2 Instance
- Step 1: Identify the unauthorized access event in the AWS CloudTrail logs or AWS Security Hub.
- Step 2: Determine the source IP address or user account associated with the unauthorized access.
- Step 3: Disable or remove the compromised user account or IAM role from the EC2 instance's security group or IAM policies.
- Step 4: Change the SSH key pair or RDP password associated with the EC2 instance.
- Step 5: Enable AWS CloudTrail logging and configure alerts to detect and respond to similar unauthorized access attempts in the future.
Example 2: Unusual Network Traffic from AWS EC2 Instance
- Step 1: Analyze the network traffic logs or VPC Flow Logs to identify the unusual traffic patterns.
- Step 2: Determine the source and destination IP addresses, ports, and protocols involved in the unusual traffic.
- Step 3: Review the security group rules associated with the EC2 instance and ensure that only necessary ports and protocols are allowed.
- Step 4: If the unusual traffic is identified as malicious, block the source IP address using AWS Network ACLs or Security Groups.
- Step 5: Implement network traffic monitoring and anomaly detection solutions to proactively identify and respond to similar incidents.
Example 3: High CPU Utilization on AWS EC2 Instance
- Step 1: Monitor the CPU utilization metrics of the EC2 instance using Amazon CloudWatch.
- Step 2: Identify the processes or applications causing the high CPU utilization.
- Step 3: Optimize the application or workload running on the EC2 instance to reduce CPU usage, such as optimizing code, improving database queries, or implementing caching mechanisms.
- Step 4: Consider resizing the EC2 instance to a higher instance type with more CPU resources if the high CPU utilization is persistent and impacting performance.
- Step 5: Set up CloudWatch alarms to notify and trigger automated actions when CPU utilization exceeds certain thresholds in the future.

Using CLI

Ensure that all EC2 instances are using the latest Amazon Machine Images (AMIs) by regularly checking for updates and patching any vulnerabilities. Use the following AWS CLI commands:
- To list all EC2 instances: aws ec2 describe-instances
- To get the latest AMI ID for a specific instance type: aws ec2 describe-images --owners amazon --filters "Name=name,Values=amzn2-ami-hvm-2.0.????????-x86_64-gp2" --query 'Images[*].[ImageId,CreationDate]' --output text | sort -k2 -r | head -n 1 | awk '{print $1}'
- To update the AMI for an instance: aws ec2 modify-instance-attribute --instance-id <instance-id> --image-id <new-ami-id>
Implement security groups and network ACLs to restrict inbound and outbound traffic to only necessary ports and protocols. Use the following AWS CLI commands:
- To create a security group: aws ec2 create-security-group --group-name <group-name> --description <group-description> --vpc-id <vpc-id>
- To add inbound rules to a security group: aws ec2 authorize-security-group-ingress --group-id <group-id> --protocol <protocol> --port <port> --source <source-ip>
- To add outbound rules to a security group: aws ec2 authorize-security-group-egress --group-id <group-id> --protocol <protocol> --port <port> --destination <destination-ip>
Enable AWS CloudTrail to monitor and log all API activity within your AWS account. Use the following AWS CLI commands:
- To create a new CloudTrail trail: aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <bucket-name> --is-multi-region-trail
- To enable CloudTrail for all regions: aws cloudtrail update-trail --name <trail-name> --is-multi-region-trail
- To start logging API activity: aws cloudtrail start-logging --name <trail-name>

Using Python

Example 1: Enforce secure communication for AWS EC2 instances using SSL/TLS:

Generate an SSL/TLS certificate for the EC2 instance using a certificate authority or a self-signed certificate.
Install the certificate on the EC2 instance and configure the web server or application to use HTTPS.
Update the security group rules to allow inbound traffic on port 443 (HTTPS) and deny traffic on port 80 (HTTP).

Python script:

# Install required packages
import subprocess
subprocess.call(['pip', 'install', 'boto3'])

import boto3

# Generate SSL/TLS certificate
client = boto3.client('acm', region_name='us-west-2')
response = client.request_certificate(
    DomainName='example.com',
    ValidationMethod='DNS'
)
certificate_arn = response['CertificateArn']

# Install certificate on EC2 instance
ec2_client = boto3.client('ec2', region_name='us-west-2')
response = ec2_client.associate_iam_instance_profile(
    IamInstanceProfile={
        'Arn': 'arn:aws:iam::123456789012:instance-profile/EC2-SSL-TLS'
    },
    InstanceId='i-1234567890abcdef0'
)
instance_profile_id = response['IamInstanceProfile']['Id']

# Configure web server or application to use HTTPS

# Update security group rules
response = ec2_client.authorize_security_group_ingress(
    GroupId='sg-0123456789abcdef0',
    IpPermissions=[
        {
            'FromPort': 443,
            'ToPort': 443,
            'IpProtocol': 'tcp',
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0'
                }
            ]
        }
    ]
)

Example 2: Enable AWS CloudTrail for EC2 instances:

Create a new AWS CloudTrail trail or update an existing trail to include EC2 instance events.
Enable CloudTrail logging for the trail and specify the S3 bucket where the logs will be stored.
Configure CloudTrail to send SNS notifications or trigger AWS Lambda functions for specific events.

Python script:

# Install required packages
import subprocess
subprocess.call(['pip', 'install', 'boto3'])

import boto3

# Create or update CloudTrail trail
client = boto3.client('cloudtrail', region_name='us-west-2')
response = client.create_trail(
    Name='EC2-CloudTrail',
    S3BucketName='my-cloudtrail-logs',
    IncludeGlobalServiceEvents=True,
    IsMultiRegionTrail=True,
    EnableLogFileValidation=True
)
trail_arn = response['TrailARN']

# Enable CloudTrail logging
response = client.start_logging(
    Name='EC2-CloudTrail'
)

# Configure CloudTrail notifications or Lambda triggers

Example 3: Implement AWS Config rules for EC2 instances:

Identify the AWS Config rules that are relevant for EC2 instances, such as checking for security group rules or instance types.
Create or update AWS Config rules using the AWS Management Console, AWS CLI, or AWS SDKs.
Monitor the AWS Config compliance dashboard or set up notifications for non-compliant EC2 instances.

Python script:

# Install required packages
import subprocess
subprocess.call(['pip', 'install', 'boto3'])

import boto3

# Create or update AWS Config rules
client = boto3.client('config', region_name='us-west-2')
response = client.put_config_rule(
    ConfigRule={
        'ConfigRuleName': 'EC2-Security-Group-Rules',
        'Description': 'Checks if EC2 instances have proper security group rules',
        'Scope': {
            'ComplianceResourceTypes': [
                'AWS::EC2::Instance'
            ]
        },
        'Source': {
            'Owner': 'AWS',
            'SourceIdentifier': 'SECURITY_GROUP_RULES_CHECK'
        }
    }
)
rule_arn = response['ConfigRuleArn']

# Monitor AWS Config compliance dashboard or set up notifications

Event Information​

Examples​

Remediation​

Using Console​

Using CLI​

Using Python​

Event Information

Examples

Remediation

Using Console

Using CLI

Using Python