Skip to main content

More Info:

This rule checks if the virtualization type of an EC2 instance is paravirtual. This rule is NON_COMPLIANT for an EC2 instance if virtualizationType is set to paravirtual.

Risk Level

Low

Address

Configuration

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of an EC2 instance using paravirtual virtualization type in AWS, you can follow these steps:
  1. Stop the EC2 Instance:
    • Navigate to the AWS Management Console and go to the EC2 dashboard.
    • Locate the EC2 instance that has the paravirtual virtualization type.
    • Select the instance and click on the “Actions” dropdown menu.
    • Choose “Instance State” and then click on “Stop Instance”.
  2. Create a Snapshot of the EC2 Instance:
    • While the instance is in a stopped state, select the instance again.
    • Click on the “Actions” dropdown menu and choose “Image and templates”, then “Create image”.
    • Follow the on-screen instructions to create an Amazon Machine Image (AMI) of the instance.
  3. Launch a New EC2 Instance with HVM Virtualization Type:
    • Once the AMI creation is complete, go to the EC2 dashboard and click on “Launch Instance”.
    • Choose the newly created AMI as the source for the new instance.
    • In the “Choose Instance Type” step, select an instance type that supports Hardware Virtual Machine (HVM) virtualization type.
    • Complete the instance launch process by configuring other settings as needed.
  4. Update Security Groups and Elastic IP (if applicable):
    • If the original EC2 instance had specific security group settings or an Elastic IP, make sure to update the new instance with the same configurations.
  5. Test the New EC2 Instance:
    • Once the new EC2 instance is up and running, test its functionality to ensure that the remediation was successful.
  6. Cleanup:
    • Once you have confirmed that the new EC2 instance is functioning correctly, you can terminate the old EC2 instance to avoid unnecessary charges.
By following these steps, you can remediate the misconfiguration of an EC2 instance using paravirtual virtualization type in AWS and ensure that it is using the appropriate HVM virtualization type.

To remediate the misconfiguration of an EC2 instance using a paravirtual virtualization type in AWS to a Hardware Virtual Machine (HVM) virtualization type, you can follow these steps using the AWS CLI:
  1. Stop the EC2 Instance:
Replace YOUR_INSTANCE_ID with the actual ID of the EC2 instance that needs to be remediated.
  1. Modify the Instance Attribute to change the virtualization type to HVM:
Replace YOUR_INSTANCE_ID with the actual ID of the EC2 instance.
  1. Start the EC2 Instance:
Replace YOUR_INSTANCE_ID with the actual ID of the EC2 instance.After following these steps, your EC2 instance should now be using the HVM virtualization type instead of the paravirtual virtualization type.
To remediate the misconfiguration of using paravirtual virtualization type for an AWS EC2 instance, you can follow these steps using Python and AWS Boto3 library:
  1. Install Boto3 library:
  1. Use the following Python script to update the virtualization type of the EC2 instance to HVM (Hardware Virtual Machine) type:
  1. Replace 'YOUR_INSTANCE_ID' with the actual instance ID of the EC2 instance that you want to update.
  2. Run the Python script, and it will update the virtualization type of the specified EC2 instance to HVM.
By following these steps, you can remediate the misconfiguration of using paravirtual virtualization type for an AWS EC2 instance using Python and Boto3 library.
  • Terraform does not expose virtualization_type directly; it is determined by the AMI.
  • To remediate, switch the instance to an HVM-based AMI (virtualization_type = "hvm" in the AMI metadata). You can find such an AMI via the AWS Console or CLI and use its ID for HVM_AMI_ID.
Important:
Changing to an HVM AMI will force replacement of the EC2 instance (aws_instance.THIS_INSTANCE will be destroyed and recreated). Plan for downtime and data preservation (use EBS volumes, snapshots, or an AMI of the existing instance as needed).
Verification:
terraform plan should show the aws_instance.THIS_INSTANCE resource being replaced, with the ami argument changing from the current paravirtual AMI ID to HVM_AMI_ID.

Additional Reading: