cis-aws-compute-2-9

name	cis-aws-compute-2.9
description	Ensure use of AWS Systems Manager to manage EC2 instances
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","systems-manager","ssm","inventory","management"]
cis_id	2.9
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.6","cis-aws-compute-2.5"]
prerequisites	[]
severity_boost	{}

Ensure use of AWS Systems Manager to manage EC2 instances

Description

An inventory and management of Amazon Elastic Compute Cloud (Amazon EC2) instances is made possible with AWS Systems Manager.

Rationale

Use AWS Systems Manager to provide detailed system configurations, operating system patch levels, services name and type, software installations, application name, publisher and version, and other details about your environment.

Impact

Setting up Systems Manager requires creating IAM users, groups, roles, and instance profiles. This adds administrative overhead but provides centralized management of EC2 instances.

Audit Procedure

Using AWS CLI

No specific CLI audit command is provided for this control. Use the console method below.

Using AWS Console

1. Login to EC2 using https://console.aws.amazon.com/systems-manager/
2. On the left Click Node Management, click Inventory.
3. On the Dashboard confirm that all of your Instances are listed as part of your inventory.

If any instances are missing or AWS Systems Manager is not configured, refer to the remediation below.

Expected Result

All EC2 instances should appear in the AWS Systems Manager Inventory dashboard.

Remediation

Using AWS CLI

No specific CLI remediation command is provided for this control. Use the console method below.

Using AWS Console

These directions already assume your AWS account is setup. They will walk you through how to create non-Admin IAM users and groups for System Manager.

1. Create a user group:

a. Login to IAM using https://console.aws.amazon.com/iam/ b. On the left Click Access management, click User groups, and then click Create Group. c. On the Create user group page, enter a name for the group. d. Select and add the users required to the Group. e. Attach permissions policies by selecting ResourceGroupsandTagEditorFullAccess policy. f. Then for Full access to Systems Manager console, click the AmazonSSMFullAccess policy.

• OR g. For access to view Systems Manager data, and not create or update resources, click the AmazonSSMReadOnlyAccess policy. h. For access to the Built-In Insights and Dashboard by CloudWatch pages in the Systems Manager console, add these policies:
• AWSHealthFullAccess