This guide consolidates AWS official best practices, CIS Benchmarks, and real-world experience to help you secure Amazon EC2 instances.

1. System Updates & Patch Management

  • Enable automatic patching with AWS Systems Manager (SSM):

    sudo yum update -y     # Amazon Linux
sudo apt-get update && sudo apt-get upgrade -y   # Ubuntu/Debian

  • Use SSM Patch Manager to automate OS/security updates across fleets:

    • Create a Patch Baseline.
    • Attach to EC2 via IAM Role with SSM managed policy.
    • Schedule via Maintenance Windows.

2. Least Privilege IAM Roles

  • Never hardcode credentials inside EC2.

  • Attach an Instance Role with only the permissions needed:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::mybucket/*"]
    }
  ]
}

  • Enable IAM Access Analyzer to detect overly broad permissions.

3. Network Security

  • Restrict inbound traffic with Security Groups:

    • Deny 0.0.0.0/0 on SSH/RDP; instead allow only trusted IP ranges.
    • Example rule: 22/tcp → 203.0.113.0/24.

  • Add Network ACLs for an extra layer of defense.

  • Require VPN/Bastion host for administrative access.

4. OS Hardening

  • Disable root login over SSH:

    sudo nano /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no

  • Enforce key-based authentication (it is preferable to only allow SSM auth)

  • Configure firewalld/ufw inside the OS for host-based filtering.

  • Remove unused software packages.

5. Disk & Data Protection

  • Encrypt EBS volumes with AWS KMS CMK.
  • Use automatic snapshot encryption for backups.
  • Enable EBS fast snapshot restore only in secure regions.
  • If handling sensitive data → enforce KMS key rotation (every 365 days).

6. Monitoring & Logging

  • Enable CloudTrail for all regions → send logs to S3 + CloudWatch Logs.

  • Use GuardDuty for continuous threat detection.

  • Enable VPC Flow Logs for visibility into network traffic.

  • Install CloudWatch Agent on EC2:

    sudo yum install amazon-cloudwatch-agent -y
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard

7. Backup & Recovery

  • Use AWS Backup with lifecycle rules for snapshots.
  • Store snapshots in separate accounts (backup vaults).
  • Regularly test recovery from snapshots/AMI.

8. Compliance & Benchmarking

  • Use AWS Security Hub with CIS EC2 controls enabled.

  • Run AWS Config with rules like:

    • restricted-ssh
    • ec2-instance-managed-by-ssm
    • ec2-ebs-encryption-by-default

Related guides:

With these steps, your EC2 instances are aligned with AWS and CIS best practices, reducing attack surface while staying auditable for compliance.