Skip to main content

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration “EC2 Instances Should Use Latest Generation” for AWS using AWS console, follow these steps:
  1. Login to your AWS console.
  2. Navigate to the EC2 dashboard.
  3. Click on the “Instances” option from the left-hand side menu.
  4. Identify the instances that are not using the latest generation.
  5. Stop the instances by selecting them and clicking on the “Instance State” option from the top menu, then selecting “Stop”.
  6. Once the instances are stopped, select them again and click on the “Actions” button from the top menu, then select “Instance Settings” and “Change Instance Type”.
  7. Select the latest generation instance type from the list and click on “Apply”.
  8. Start the instances again by selecting them and clicking on the “Instance State” option from the top menu, then selecting “Start”.
After completing these steps, your EC2 instances will be using the latest generation.

To remediate the misconfiguration “EC2 Instances Should Use Latest Generation” for AWS using AWS CLI, follow the below steps:
  1. Open the AWS CLI on your local machine.
  2. Run the following command to list all the EC2 instances in your AWS account:
  1. Identify the instances that are not using the latest generation.
  2. Stop the instance using the following command:
Make sure to replace <instance-id> with the actual ID of the instance that needs to be stopped.
  1. Once the instance is stopped, update the instance type to the latest generation using the following command:
Replace <instance-id> with the actual ID of the instance that needs to be updated, and <instance-type> with the latest generation instance type.
  1. Start the instance using the following command:
Make sure to replace <instance-id> with the actual ID of the instance that needs to be started.
  1. Verify that the instance is running and using the latest generation instance type.
Repeat the above steps for all the instances that are not using the latest generation.
To remediate the EC2 Instances Should Use Latest Generation misconfiguration for AWS using Python, you can follow these steps:
  1. Identify all the EC2 instances running in your AWS account that are not using the latest generation.
  2. Use the AWS SDK for Python (Boto3) to create a list of all the instances that are not using the latest generation.
  3. Use the Boto3 EC2 client to stop the instances that are not using the latest generation.
  4. Use the Boto3 EC2 client to modify the instance type to the latest generation.
  5. Use the Boto3 EC2 client to start the instances again.
Here is a sample Python code that can be used to remediate the EC2 Instances Should Use Latest Generation misconfiguration in AWS:
Note: This code assumes that the latest generation instance type is t3.micro. You may need to modify the instance type value based on your specific requirements.
  • This change updates the instance_type to a newer-generation EC2 type, matching the CLI remediation (modify-instance-attribute --instance-type "NEW_INSTANCE_TYPE").
  • Terraform will stop and restart the instance to apply the new type, which causes downtime but does not force resource replacement.
  • Be sure the new type is compatible with your AMI, architecture, and workload; if the instance uses instance-store volumes, any data on them will be lost when the instance is stopped.
Verification with terraform plan:
  • You should see an in-place update on aws_instance.THIS_INSTANCE with:
    • ~ instance_type: "OLD_INSTANCE_TYPE" => "NEW_INSTANCE_TYPE"
  • No -/+ (destroy/create) should appear for this instance.