Overview
This report assesses AWS resources against 30 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.
EC2 Instances
- EC2 Instance Metadata Service v2 Enforced
- EC2 Instances in a VPC (No Classic EC2)
- EC2 Instance not launched with Key Pair
- EC2 Instances Older than 1 Year
- Ensure Restricted Remote Administration Ports (SSH/RDP) Access to EC2 Instances
- EC2 Detailed Monitoring Enabled
- EC2 Instances Managed by Systems Manager (SSM)
- EC2 Instances Compliant with SSM Patching Requirements
EBS Volumes
- EC2 Instance EBS Optimization Enabled
EC2 Instance Roles
- IAM Instance Profile is Attached to EC2 Instance
- EC2 instance IAM should not allow pass role and lambda invoke function access
- EC2 instance IAM role should not allow management level access
- EC2 instance IAM role should not allow data destruction access
- EC2 instance IAM role should not allow cloud log tampering access
- EC2 instance IAM role should not allow database management write access
- EC2 instance IAM role should not allow destruction KMS access
- EC2 instance IAM role should not allow destruction RDS access
EC2 AMIs
- Ensure Images (AMI) are not older than 90 days
EC2 User Data
- EC2 instances user data should not have secrets
EC2 Network Interfaces
- EC2 network interfaces should have source/destination checking enabled
- Ensure unused ENIs are removed
Auto Scaling Groups
- EC2 Auto Scaling Groups Should Use EC2 Launch Templates
- Auto Scaling Group Has No Suspended Processes
- Auto Scaling Group Propagates Tags to EC2 Instances
Auto Scaling Launch Configurations
- Auto Scaling Launch Configuration Metadata Response Hop Limit is 1
- Auto Scaling Launch Configuration has IMDSv2 Enforced
- Auto Scaling Launch Configuration Instances Do Not Assign Public IPs
- Auto Scaling Launch Config User Data Has No Sensitive Data
Systems Manager Automation
- EC2 Instance Compliant SSM Association Status
- Systems Manager (SSM) Agent Auto-Update Enabled
The report includes actionable findings and remediation guidance for supported checks.