EC2 instance has detailed monitoring enabled
ec2_instance_detailed_monitoring_enabled
EC2 instances are assessed for CloudWatch detailed monitoring, indicating whether 1-minute metrics collection is enabled.
Instances lacking this setting provide only 5-minute metrics.
Risk
Without 1-minute metrics, visibility drops, delaying detection of:
- Sudden CPU/network/disk spikes affecting availability
- Malicious workloads (crypto-mining, brute force)
- Data exfiltration patterns Slower detection expands blast radius, raising incident impact and response cost.
prowler aws --checks ec2_instance_detailed_monitoring_enabled
Recommendation
Enable detailed monitoring to collect 1-minute metrics on critical instances. Use defense in depth: baseline normal behavior, create alerts for anomalies, and correlate metrics with logs and traces. Review dashboards regularly. If costs matter, prioritize production, internet-facing, and autoscaling fleets.
Remediation
aws ec2 monitor-instances --instance-ids <EC2_INSTANCE_ID>
- Open the AWS Console and go to EC2 > Instances
- Select the instance
- Choose Actions > Monitor and troubleshoot > Manage detailed monitoring
- Check Enable detailed monitoring and click Save
Source Code
Resource Type
AwsEc2Instance
References
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/EC2/instance-detailed-monitoring.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html#enable-detailed-monitoring-instance