EC2 instance has not been stopped longer than the configured maximum days
ec2_instance_stopped_older_than_specific_days
EC2 instances in the stopped state are evaluated for how long they have remained stopped. Instances stopped beyond the configurable limit (max_ec2_instance_stopped_days, default 30) are flagged. Running, pending, and other non-stopped instances pass.
Risk
Long-stopped instances remain unmonitored and unpatched while still retaining EBS volumes, network configuration, IAM instance profiles, and SSH keys. This expands attack surface and incurs unnecessary storage cost. Stale AMIs and credentials attached to abandoned instances increase the chance of compromise if the instance is later started.
prowler aws --checks ec2_instance_stopped_older_than_specific_days
arn:partition:ec2:region:account-id:instance/instance-id
Recommendation
Establish a lifecycle policy for stopped instances:
- Tag instances with owner and expiry
- Terminate instances no longer needed to reclaim EBS cost
- If retained, start regularly for patching or rebuild from a hardened AMI
- Prefer ephemeral, autoscaled workloads over long-lived stopped hosts
Adjust max_ec2_instance_stopped_days to match policy.
Remediation
aws ec2 terminate-instances --instance-ids <example_resource_id>
- Sign in to the AWS Management Console and open EC2
- Go to Instances and select the long-stopped instance
- Review attached EBS volumes, tags, and ownership
- Choose Instance state > Terminate instance (or Start instance if still needed, then patch/rebuild)
- Confirm and verify the instance is terminated or returned to an actively managed lifecycle
Source Code
Resource Type
AwsEc2Instance
References
Related To
- ec2_instance_older_than_specific_days