EC2 Instances Should Not Reach vCPU Limit

Using Console

To remediate the misconfiguration “EC2 Instances Should Not Reach vCPU Limit” in AWS using the AWS console, follow the below steps:

Open the AWS Management Console and navigate to the EC2 dashboard.
Select the EC2 instance that is reaching the vCPU limit.
Click on the “Actions” button and select “Instance Settings” and then click on “Change Instance Type”.
Select a larger instance type that provides more vCPUs than the current instance type.
Review the changes and click on “Apply”.
Once the instance type is changed, the instance will have more vCPUs and the vCPU limit will no longer be reached.

Alternatively, you can also use AWS Auto Scaling to automatically adjust the instance type based on the resource utilization of the instance. This will ensure that the instance always has enough vCPUs and other resources to handle the workload.

Using CLI

To remediate the EC2 instances reaching vCPU limit misconfiguration in AWS using AWS CLI, follow the below steps:Step 1: Log in to the AWS Management Console.Step 2: Open the AWS CLI on your local machine.Step 3: Use the below command to describe the EC2 instances that have reached the vCPU limit:

aws ec2 describe-instances --query 'Reservations[].Instances[?CpuOptions.CpuCreditsRemaining==`0`].{InstanceID:InstanceId, vCPUs:CpuOptions.CoreCount}'

This command will display the list of instances that have reached the vCPU limit.Step 4: Stop the EC2 instances that have reached the vCPU limit using the below command:

aws ec2 stop-instances --instance-ids <instance-id>

Replace the <instance-id> with the actual instance ID of the instance that you want to stop.Step 5: Modify the instance type of the stopped instances using the below command:

aws ec2 modify-instance-attribute --instance-id <instance-id> --instance-type <new-instance-type>

Replace <instance-id> with the actual instance ID of the instance that you want to modify, and <new-instance-type> with the desired instance type.Step 6: Start the modified EC2 instances using the below command:

aws ec2 start-instances --instance-ids <instance-id>

Replace the <instance-id> with the actual instance ID of the instance that you want to start.By following these steps, you can remediate the EC2 instances reaching vCPU limit misconfiguration in AWS using AWS CLI.

Using Python

To remediate the EC2 Instances reaching vCPU limit misconfiguration in AWS using python, you can follow the below steps:Step 1: Identify the EC2 instances which are reaching vCPU limit using the boto3 library in python.

import boto3

# Create EC2 client
ec2 = boto3.client('ec2')

# Get all EC2 instances
reservations = ec2.describe_instances()

for reservation in reservations['Reservations']:
    for instance in reservation['Instances']:
        # Check if the instance is running and has a vCPU limit
        if instance['State']['Name'] == 'running' and 'CpuOptions' in instance and 'CoreCount' in instance['CpuOptions']:
            # Check if the instance is reaching the vCPU limit
            if instance['CpuOptions']['CoreCount'] >= instance['CpuOptions']['ThreadsPerCore']:
                # Remediate the misconfiguration by stopping and starting the instance
                ec2.stop_instances(InstanceIds=[instance['InstanceId']])
                ec2.start_instances(InstanceIds=[instance['InstanceId']])

Step 2: Stop and start the EC2 instances which are reaching the vCPU limit to remediate the misconfiguration.

# Stop and start the instances which are reaching the vCPU limit
ec2.stop_instances(InstanceIds=[instance['InstanceId']])
ec2.start_instances(InstanceIds=[instance['InstanceId']])

By following the above steps, you can remediate the EC2 Instances reaching vCPU limit misconfiguration in AWS using python.

Using Terraform

# Stop a non-critical EC2 instance to reduce vCPU usage
resource "aws_ec2_instance_state" "stop_instance" {
  instance_id = aws_instance.TARGET_INSTANCE.id  # Replace with the instance you want to stop
  state       = "stopped"
}

# Example EC2 instance this state resource controls
resource "aws_instance" "TARGET_INSTANCE" {
  ami                    = "AMI_ID"              # Replace with a valid AMI ID
  instance_type          = "INSTANCE_TYPE"       # Replace with desired instance type
  subnet_id              = "SUBNET_ID"           # Replace with a subnet ID
  vpc_security_group_ids = ["SECURITY_GROUP_ID"] # Replace with security group IDs

  tags = {
    Name = "INSTANCE_NAME"                       # Replace with a meaningful name
  }
}

Stopping the instance with aws_ec2_instance_state will cause service interruption but preserves data on attached EBS volumes; it does not terminate the instance.To permanently terminate an instance via Terraform, you remove (or set count = 0/for_each = {} on) the aws_instance resource representing it and apply; this is a destructive and irreversible action and will delete the instance, and depending on its root_block_device settings, may also delete the root EBS volume and any instance-store data.AWS Service Quotas vCPU limit increases (aws service-quotas request-service-quota-increase) cannot currently be requested or managed via the Terraform AWS provider; they must be done manually or via the AWS CLI/SDK as in the provided commands.For verification, terraform plan should show:

For stopping: a planned change to aws_ec2_instance_state.stop_instance with state transitioning from running (or pending) to stopped.
For termination: the aws_instance.TARGET_INSTANCE resource marked with -/+ (destroy and recreate elsewhere) or - (destroy) if you removed it, confirming the instance will be terminated.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

EC2 Instances Should Not Reach vCPU Limit

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: