EC2 Security
Compute & ServerlessEC2 Security encompasses the controls needed to protect virtual machines running in AWS. EC2 instances are a top target because they often hold application code, data, and credentials.
Key Security Controls
- IMDSv2: enforce Instance Metadata Service v2 (token-required) to prevent SSRF attacks from stealing credentials; IMDSv1 should be disabled
- Instance Profiles: use IAM roles (not access keys) for EC2 to access other AWS services
- Security Groups: stateful firewall rules; deny all inbound by default, open only required ports
- EBS Encryption: enable default encryption for all new EBS volumes in each region
- Key Pairs: use EC2 Instance Connect or SSM Session Manager instead of managing SSH keys
- Patching: use SSM Patch Manager for automated OS and application patching
- Nitro Enclaves: isolated compute environments for processing highly sensitive data
Common Risks
- IMDSv1 enabled, allowing SSRF to steal instance role credentials
- Security groups with
0.0.0.0/0on SSH (port 22) or RDP (port 3389) - Unencrypted EBS volumes containing sensitive data
- Unpatched instances with known CVEs
Related Terms
A virtual firewall for EC2 instances and other resources that controls inbound and outbound traffic at the instance level using allow rules.
An AWS identity with temporary credentials that can be assumed by users, services, or applications to perform actions without long-term access keys.
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
Dividing a network into isolated segments (subnets, VPCs) to limit lateral movement and contain the blast radius of a security breach.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.