EC2 instances are evaluated for their virtualization mode. Instances with virtualization_type set to paravirtual are identified; those using HVM are recognized as hardware-assisted virtualization.
Risk
Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.
prowler aws --checks ec2_instance_paravirtual_type
Recommendation
Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.
Remediation
aws ec2 terminate-instances --instance-ids <INSTANCE_ID>
- In the AWS Console, go to EC2 > Instances and select the instance with Virtualization type = paravirtual
- Launch a replacement instance using any HVM-based AMI (e.g., Amazon Linux 2)
- Verify the new instance is running
- Back in EC2 > Instances, select the paravirtual instance, choose Instance state > Terminate instance, and confirm
Source Code
Resource Type
AwsEc2Instance