Skip to main content

More Info:

Overutilized EC2 instances should be upgraded to optimize application response time.

Risk Level

Low

Address

Operational Maturity, Reliability

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the issue of EC2 instances being overutilized in AWS, follow these steps:
  1. Log in to the AWS Management Console.
  2. Navigate to the EC2 Dashboard.
  3. Select the EC2 instance that is overutilized.
  4. Check the CPU utilization of the instance in the Monitoring tab.
  5. Determine the root cause of the overutilization. It could be due to high traffic, a memory leak, or a poorly optimized application.
  6. Based on the root cause, take the following actions:
    • If it is due to high traffic, consider scaling out the instance by adding more instances or upgrading the instance type.
    • If it is due to a memory leak, investigate the application code and fix the leak.
    • If it is due to a poorly optimized application, work with the developers to optimize the application.
  7. Monitor the CPU utilization of the instance and ensure that it stays within acceptable limits.

To remediate the misconfiguration “EC2 Instances Should Not Be Overutilized” for AWS, you can follow the below steps using AWS CLI:
  1. Identify the overutilized EC2 instances using the CloudWatch metrics. Run the following command to get the CPU utilization of all the EC2 instances in your AWS account:
    Replace <instance_id> with the ID of the EC2 instance you want to check, <start_time> with the start time of the period you want to check, and <end_time> with the end time of the period you want to check.
  2. Once you have identified the overutilized EC2 instances, you can either upgrade the instance type or add more instances to the auto-scaling group. To upgrade the instance type, stop the instance and then change the instance type from the AWS Management Console or by running the following command:
    Replace <instance_id> with the ID of the EC2 instance you want to modify and <instance_type> with the new instance type you want to use.
  3. If you want to add more instances to the auto-scaling group, run the following command:
    Replace <auto_scaling_group_name> with the name of the auto-scaling group you want to modify, <min_size> with the minimum number of instances you want to have in the group, <desired_capacity> with the desired number of instances you want to have in the group, and <max_size> with the maximum number of instances you want to have in the group.
  4. After you have made the necessary changes, monitor the CPU utilization of the EC2 instances using CloudWatch metrics to ensure that they are not overutilized.
To remediate the misconfiguration of EC2 instances being overutilized in AWS using Python, follow these steps:
  1. First, you need to identify the overutilized instances. You can use CloudWatch to monitor the CPU utilization of your instances and set alarms to notify you when the utilization exceeds a certain threshold. You can also use AWS Trusted Advisor to get recommendations on overutilized instances.
  2. Once you have identified the overutilized instances, you can use the AWS SDK for Python (Boto3) to stop or terminate the instances. Here’s an example code snippet to stop an EC2 instance:
Replace ‘INSTANCE_ID’ with the ID of the overutilized instance.
  1. You can also use AWS Auto Scaling to automatically adjust the number of instances in your fleet based on demand. Auto Scaling can launch new instances when demand increases and terminate instances when demand decreases, ensuring that your fleet is always right-sized.
  2. Finally, you should review your instance types and consider upgrading to a larger instance type if your workload requires more resources. You can use AWS Cost Explorer to analyze your costs and identify opportunities to optimize your instance usage.
Changing instance_type on an existing aws_instance will cause Terraform to stop the instance, apply the new type, and start it again, resulting in downtime; ensure the new type is compatible with the current instance (architecture, virtualization, etc.), and take EBS snapshots beforehand.If the instance is actually managed by an Auto Scaling group, update the instance_type on the corresponding aws_launch_template or aws_launch_configuration instead and let the group replace instances.Verification: terraform plan should show an in-place update of the aws_instance with instance_type changing from the current value (e.g., t3.medium) to NEW_INSTANCE_TYPE, with no -/+ (destroy/create) for the instance resource.

Additional Reading: