EC2 instance is managed by AWS Systems Manager or not running
ec2_instance_managed_by_ssm
EC2 instances are assessed for enrollment as Systems Manager managed nodes. Running instances lacking Systems Manager registration are marked as unmanaged; instances in stopped, terminated, or pending states are noted separately.
Risk
Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.
prowler aws --checks ec2_instance_managed_by_ssm
Recommendation
Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.
Remediation
aws ec2 stop-instances --instance-ids <INSTANCE_ID>
- In IAM console: Create role > AWS service > EC2 > Next; attach policy "AmazonSSMManagedInstanceCore"; Create role
- In EC2 console: Instances > select the instance > Actions > Security > Modify IAM role > choose the role created above > Update IAM role
- Wait a few minutes; in Systems Manager console: Managed nodes, verify the instance shows as Online
- If the instance OS does not include SSM Agent by default, install the SSM Agent for that OS, then verify again
Source Code
Resource Type
AwsEc2Instance