HIGH
Source
CloudSploit
ID
ec2-max-instances

EC2 Max Instances

Ensures the total number of EC2 instances does not exceed a set threshold.

The number of running EC2 instances should be carefully audited, especially in unused regions, to ensure only approved applications are consuming compute resources. Many compromised AWS accounts see large numbers of EC2 instances launched.

Follow the appropriate remediation steps below to resolve the issue.

  1. Log in to the AWS Management Console.

  2. Select the “Services” option and search for EC2. Step

  3. Scroll down the left navigation panel and choose “Instances”.

  4. Check the total number of EC2 instances at the top left corner available in the selected AWS region. Step

  5. Repeat steps number 2 - 4 to check the threshold value for other regions. If the total number of running EC2 instances provisioned in your AWS account is greater than 50, the recommended threshold was exceeded. AWS has different threshold values as well depends on the region. Raise an AWS support ticket to limit the number of instances as per the requirements.

  6. Scroll down the left navigation panel and choose “Instances”. Verify all the “Instances” running and terminate any “Instances” which are not required.

  7. Choose the “EC2 Instances” which are not required from the “Instances” configuration page. Step

  8. Click on the “Instance State” button at the top panel and click on “Stop instance” if you want to only stop the selected “EC2 Instance” and not terminate. Step

  9. Click on the “Instance state” button at the top panel and click on “Terminate Instance” to terminate the selected “EC2 Instance”. Step

  10. On the “Terminate Instance” dialog box click on the “Terminate” button.Step

  11. Repeat steps number 6 - 10 to remove the “EC2 Instances” which are not required.