Infrastructure Security · Topic 4 of 7

EC2 Instance Hardening and Patching

Harden EC2 with golden AMIs from Image Builder, Session Manager access, Patch Manager, IMDSv2, instance profiles, EBS encryption and Inspector scanning.

5 min

In a nutshell

Build golden AMIs with EC2 Image Builder, and control who can launch which AMIs.
Session Manager removes the need for inbound SSH, bastions and key management, and logs sessions to S3 or CloudWatch Logs.
The instance needs the SSM Agent and AmazonSSMManagedInstanceCore in its instance profile to be managed.

What it is

Securing EC2 means controlling what runs on the instance, how people reach it, how it gets patched and what credentials it holds. AWS secures the hypervisor and hardware, and you secure the guest operating system, the applications and the access.

The pattern the exam rewards is to build hardened images once, give no inbound administrative ports, patch on a schedule and scan continuously.

How it works

Golden images

A golden AMI (Amazon Machine Image) is a pre hardened image with the agent, monitoring and security settings you require. EC2 Image Builder automates building it: a pipeline applies components, such as operating system hardening and software installation, runs tests, and distributes the finished AMI to chosen Regions and accounts on a schedule.

Control which images may be launched. Share approved AMIs only to the accounts that need them, tag them, and restrict launches with an IAM or service control policy condition, or with the EC2 Allowed AMIs setting that limits the images an account can use. Encrypt AMI snapshots, and deprecate old images.

Access without open ports

AWS Systems Manager Session Manager gives shell access without inbound ports, bastion hosts or SSH keys. The instance needs the SSM Agent, an instance profile with the AmazonSSMManagedInstanceCore managed policy, and a network path to the Systems Manager endpoints, which can be internet or VPC interface endpoints.

Session Manager access is controlled by IAM, logged in CloudTrail, and the session content can be logged to S3 or CloudWatch Logs and encrypted with KMS.

Option	Inbound port needed	Audit	Choose it when
Session Manager	None	IAM, CloudTrail, session logs	Default for administrators
EC2 Instance Connect	22 from allowed sources	CloudTrail	Short lived keys are enough
Bastion host with SSH	22 on the bastion	Host logs	You must support legacy SSH tooling

Patching

Systems Manager Patch Manager scans and installs operating system patches using a patch baseline that defines which patches are approved and after how many days. Targets are grouped by tags or patch groups, and patching runs inside a maintenance window. Use scan only mode first to report compliance, then install in a window.

For immutable fleets, patch the image and replace instances rather than patching in place. Both approaches can coexist: patch the image regularly and use Patch Manager to report drift.

Instance metadata service

Applications on the instance can read credentials from the instance metadata service (IMDS). Version 2 (IMDSv2) uses session tokens, which blocks many server side request forgery (SSRF) attacks against version 1 style requests.

# AWS CLI: require IMDSv2 on an existing instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled

A lower hop limit prevents containers on the host from reaching the metadata service if you do not intend them to. Set IMDSv2 as the default for new launches with account level settings, or enforce it with a policy condition on ec2:MetadataHttpTokens.

Credentials and encryption

Instance profile. Give the instance an IAM role with only the permissions the application needs. Never store access keys on the instance.
EBS encryption. Turn on encryption by default for each Region so every new volume and snapshot copy is encrypted. Use a customer managed KMS key when you need control over key policy and sharing.
Key pairs. Protect private keys, and prefer Session Manager so that fewer keys exist.
Security groups. Open only required ports, and reference other security groups instead of wide address ranges.

# AWS CLI: enable EBS encryption by default in the current Region
aws ec2 enable-ebs-encryption-by-default

Vulnerability and compliance scanning

Amazon Inspector scans running instances for known vulnerabilities and unintended network exposure, continuously and without scheduling. It uses the SSM Agent, or scans the volumes without an agent when configured. AWS Config rules and Security Hub standards check settings such as unencrypted volumes and public addresses.

Amazon GuardDuty Runtime Monitoring and Malware Protection add threat detection, and AWS Systems Manager State Manager keeps desired configuration applied.

Dedicated hardware and Nitro

Nitro based instances offload virtualization to dedicated hardware and isolate the hypervisor. For compliance, dedicated hosts or instances provide hardware not shared with other customers, and Nitro Enclaves give an isolated environment for processing very sensitive data with no persistent storage or external networking.

What to remember for the exam

Build golden AMIs with EC2 Image Builder, and control who can launch which AMIs.
Session Manager removes the need for inbound SSH, bastions and key management, and logs sessions to S3 or CloudWatch Logs.
The instance needs the SSM Agent and AmazonSSMManagedInstanceCore in its instance profile to be managed.
Patch Manager uses patch baselines, groups and maintenance windows, and can scan or install.
Require IMDSv2 with --http-tokens required, to defend against SSRF credential theft.
Never store long term access keys on instances. Use instance profiles.
Enable EBS encryption by default per Region, and use a customer managed key when sharing or control is needed.
Inspector scans instances continuously for vulnerabilities, and Nitro Enclaves isolate sensitive processing.

Exam tip

When the choices include a bastion host, SSH keys and Session Manager, the exam answer is almost always Session Manager unless it states a reason that rules it out.

Common mistakes

Opening port 22 to the world. Use Session Manager, or limit SSH to a known address range.

Leaving IMDSv1 enabled. A web application SSRF flaw can then fetch role credentials with a simple request.

Forgetting the network path for Session Manager. Instances in private subnets without NAT need interface endpoints for ssm, ssmmessages and ec2messages.

Assuming default encryption fixes old volumes. It applies to new volumes only, so existing unencrypted volumes need a snapshot and copy.

Watch out

Encryption by default is set per Region and per account, so an unmanaged Region can still create unencrypted volumes unless you enforce it in every Region.

Check yourself

How can administrators reach private instances with no inbound ports open?
Use Systems Manager Session Manager, which needs the SSM Agent, an instance profile and access to the SSM endpoints.
Which setting defends against SSRF theft of instance role credentials?
Requiring IMDSv2 by setting the metadata option http-tokens to required.
What does a patch baseline define?
Which patches are approved for installation and the rules for approving them, such as an auto approval delay.

Topic 4 of 7 in Infrastructure Security

Test yourself on Infrastructure Security

The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.