cis-aws-compute-2-5

name	cis-aws-compute-2.5
description	Ensure no AWS EC2 Instances are Older than 180 days
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","instance-age","lifecycle","patching"]
cis_id	2.5
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.1.4","cis-aws-compute-2.11"]
prerequisites	[]
severity_boost	{}

Ensure no AWS EC2 Instances are Older than 180 days

Description

Identify any running AWS EC2 instances older than 180 days.

Rationale

An EC2 instance is not supposed to run indefinitely and having instance older than 180 days can increase the risk of problems and issues.

Impact

Stopping and restarting instances will change the launch time and may cause temporary service disruption. Plan for maintenance windows when refreshing long-running instances.

Audit Procedure

Using AWS CLI

1. Run the describe-instances command:

aws ec2 describe-instances --region us-east-1 --output json --filters "Name=instance-state-code,Values=16" --query "Reservations[*].Instances[*].{Instance:InstanceId}"

2. The output should look like this:

[
  [
    {
      "Instance": "i-1234567abcdefghi0"
    }
  ],
  [
    {
      "Instance": "i-1234567abcdefghi0"
    }
  ]
]

3. Run the describe-instances command for each instance ID listed:

aws ec2 describe-instances --region us-east-1 --instance-ids i-1234567abcdefghi0 --query "Reservations[*].Instances[*].LaunchTime"

4. The command output should return the instance launch date in human readable format:

"2021-06-11T15:04:52+00:00"

5. If the selected instance was launched more than 180 days ago, refer to the remediation below.
6. Repeat steps 3 and 4 to verify the launch date for all instances listed.
7. Repeat steps 1 - 6 for the other AWS regions.

Using AWS Console

1. Login to EC2 using https://console.aws.amazon.com/ec2/