EC2 instance has detailed monitoring enabled

Check ID: ec2_instance_detailed_monitoring_enabled
Provider: AWS
Service: ec2
Severity: LOW
Categories: logging, forensics-ready
Resource type: AwsEc2Instance

What this check verifies

EC2 instances are assessed for CloudWatch detailed monitoring, indicating whether 1-minute metrics collection is enabled. Instances lacking this setting provide only 5-minute metrics.

Risk

Without 1-minute metrics, visibility drops, delaying detection of:

Sudden CPU/network/disk spikes affecting availability
Malicious workloads (crypto-mining, brute force)
Data exfiltration patterns Slower detection expands blast radius, raising incident impact and response cost.

Recommendation

Enable detailed monitoring to collect 1-minute metrics on critical instances. Use defense in depth: baseline normal behavior, create alerts for anomalies, and correlate metrics with logs and traces. Review dashboards regularly. If costs matter, prioritize production, internet-facing, and autoscaling fleets.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 monitor-instances —instance-ids <EC2_INSTANCE_ID>

# Enable detailed monitoring on an EC2 instance
resource "aws_instance" "<example_resource_name>" {
  ami           = "<example_ami_id>"
  instance_type = "<example_instance_type>"
  monitoring    = true  # Critical: enables detailed (1-minute) CloudWatch monitoring
}

# CloudFormation: Enable detailed monitoring on an EC2 instance
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: "<example_ami_id>"
      InstanceType: "<example_instance_type>"
      Monitoring: true  # Critical: enables detailed (1-minute) CloudWatch monitoring

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_detailed_monitoring_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires