Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · EC2

EC2.4: Long-stopped instances are abandoned attack surface

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub EC2.4 check?

EC2.4 fails for any EC2 instance that has been in the stopped state longer than the allowed threshold — 30 days by default. It is backed by the AWS Config rule ec2-stopped-instance, which reads the timestamp embedded in StateTransitionReason and compares it against the AllowedDays parameter.

Why does EC2.4 matter?

A long-stopped instance is a frozen attack surface: it has missed every OS and package patch, its baked-in credentials and SSH keys may be stale, and orchestration tooling can restart it without a human decision — putting an unpatched, unmonitored host back on the network. It is also a quiet cost, since the attached EBS volumes keep billing while the instance does nothing.

How do I fix EC2.4?

  1. List stopped instances with their LaunchTime, StateTransitionReason, and owner tags, then classify each as intentionally held or abandoned.
  2. Snapshot every attached volume with create-snapshots before anything destructive, tagged so the data is recoverable.
  3. Deregister any AMIs derived from the instance, then terminate it so the EBS billing stops and the finding clears.
  4. Tune the AWS Config rule's AllowedDays and add a tagging policy with ExpiresAt so the queue cannot refill.

Remediation script · bash

# Snapshot, deregister, terminate — the safe retire flow for one instance.
INSTANCE=i-0a1b2c3d4e5f60002

aws ec2 create-snapshots \
  --instance-specification InstanceId=$INSTANCE,ExcludeBootVolume=false \
  --description "EC2.4 cleanup pre-terminate $INSTANCE" \
  --tag-specifications "ResourceType=snapshot,Tags=[{Key=Purpose,Value=ec2.4-cleanup},{Key=SourceInstance,Value=$INSTANCE}]"

# Find any AMIs derived from this instance and deregister them.
aws ec2 describe-images --owners self \
  --filters Name=tag:SourceInstance,Values=$INSTANCE \
  --query 'Images[].ImageId' --output text | \
  xargs -n1 -r aws ec2 deregister-image --image-id

aws ec2 terminate-instances --instance-ids $INSTANCE

Full walkthrough (console steps, edge cases and verification) in the lesson Remove long-stopped EC2 instances.

Full lesson Remove long-stopped EC2 instances Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for EC2 controls ↗ Check your own account for EC2.4 →
Part of the learning path Right-size your compute

More EC2 controls

  • EC2.1 An EBS snapshot is publicly restorable by any account
  • EC2.2 Default security groups still allow traffic
  • EC2.3 Attached EBS volumes are not encrypted at rest
  • EC2.6 No VPC flow logs, so there is no network audit trail
  • EC2.7 New EBS volumes are not encrypted by default
  • EC2.8 IMDSv1 lets an SSRF steal instance credentials
  • EC2.9 Instances are directly reachable on public IPv4
  • EC2.10 EC2 API traffic leaves the VPC over the internet
  • EC2.13 SSH (port 22) is open to the entire internet
  • EC2.14 RDP (port 3389) is open to the entire internet
  • EC2.15 Subnets auto-assign public IPs to new instances
  • EC2.17 Instances with multiple ENIs can bridge network boundaries