Skip to main content

More Info:

Your AWS servers should be using the latest generation of EC2 instances for price-performance improvements.

Risk Level

Low

Address

Cost optimization

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration “EC2 Instances Should Use Latest Generation” for AWS using AWS console, follow these steps:
  1. Login to your AWS console.
  2. Navigate to the EC2 dashboard.
  3. Click on the “Instances” option from the left-hand side menu.
  4. Identify the instances that are not using the latest generation.
  5. Stop the instances by selecting them and clicking on the “Instance State” option from the top menu, then selecting “Stop”.
  6. Once the instances are stopped, select them again and click on the “Actions” button from the top menu, then select “Instance Settings” and “Change Instance Type”.
  7. Select the latest generation instance type from the list and click on “Apply”.
  8. Start the instances again by selecting them and clicking on the “Instance State” option from the top menu, then selecting “Start”.
After completing these steps, your EC2 instances will be using the latest generation.

To remediate the misconfiguration “EC2 Instances Should Use Latest Generation” for AWS using AWS CLI, follow the below steps:
  1. Open the AWS CLI on your local machine.
  2. Run the following command to list all the EC2 instances in your AWS account:
  1. Identify the instances that are not using the latest generation.
  2. Stop the instance using the following command:
Make sure to replace <instance-id> with the actual ID of the instance that needs to be stopped.
  1. Once the instance is stopped, update the instance type to the latest generation using the following command:
Replace <instance-id> with the actual ID of the instance that needs to be updated, and <instance-type> with the latest generation instance type.
  1. Start the instance using the following command:
Make sure to replace <instance-id> with the actual ID of the instance that needs to be started.
  1. Verify that the instance is running and using the latest generation instance type.
Repeat the above steps for all the instances that are not using the latest generation.
To remediate the EC2 Instances Should Use Latest Generation misconfiguration for AWS using Python, you can follow these steps:
  1. Identify all the EC2 instances running in your AWS account that are not using the latest generation.
  2. Use the AWS SDK for Python (Boto3) to create a list of all the instances that are not using the latest generation.
  3. Use the Boto3 EC2 client to stop the instances that are not using the latest generation.
  4. Use the Boto3 EC2 client to modify the instance type to the latest generation.
  5. Use the Boto3 EC2 client to start the instances again.
Here is a sample Python code that can be used to remediate the EC2 Instances Should Use Latest Generation misconfiguration in AWS:
Note: This code assumes that the latest generation instance type is t3.micro. You may need to modify the instance type value based on your specific requirements.
  • This change updates the instance_type to a newer-generation EC2 type, matching the CLI remediation (modify-instance-attribute --instance-type "NEW_INSTANCE_TYPE").
  • Terraform will stop and restart the instance to apply the new type, which causes downtime but does not force resource replacement.
  • Be sure the new type is compatible with your AMI, architecture, and workload; if the instance uses instance-store volumes, any data on them will be lost when the instance is stopped.
Verification with terraform plan:
  • You should see an in-place update on aws_instance.THIS_INSTANCE with:
    • ~ instance_type: "OLD_INSTANCE_TYPE" => "NEW_INSTANCE_TYPE"
  • No -/+ (destroy/create) should appear for this instance.

Additional Reading: