EC2 instance is not older than the configured maximum age or is not running
ec2_instance_older_than_specific_days
EC2 instances are evaluated for age while in running state. Instances launched beyond the configurable limit (max_ec2_instance_age_in_days, default 180) are flagged as older than the allowed lifetime. Stopped instances are ignored.
Risk
Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability
Aged hosts also drift from baselines and impede response.
Run this check with Prowler CLI
prowler aws --checks ec2_instance_older_than_specific_days
Recommendation
Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius
Adjust max_ec2_instance_age_in_days to match policy.
Remediation
CLI
aws ec2 stop-instances --instance-ids <example_resource_id>
Other
- Sign in to the AWS Management Console and open EC2
- Go to Instances and select the noncompliant instance
- Choose Instance state > Stop instance
- Confirm Stop
- Verify the instance state is Stopped (the check passes when the instance is not running)
Source Code
Resource Type
AwsEc2Instance