Internet-facing EC2 instance has no instance profile

Check ID: ec2_instance_internet_facing_with_instance_profile
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed, identity-access
Resource type: AwsEc2Instance

What this check verifies

EC2 instances with a public IP address and an attached instance profile (IAM role) are identified. Instances lacking public exposure or without an instance profile are excluded.

Risk

Publicly reachable instances with IAM role credentials expand the blast radius. Remote exploits or misconfigurations can steal credentials via the instance metadata service, enabling unauthorized API calls, data exfiltration, and lateral movement, impacting confidentiality, integrity, and availability.

Recommendation

Avoid direct Internet exposure. Place workloads behind an Application Load Balancer and protect HTTP apps with WAF. Remove public IPs or restrict ingress to trusted sources. Apply least privilege to instance profiles and enforce IMDSv2. Use bastion hosts or Session Manager for admin access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 disassociate-iam-instance-profile —association-id <ASSOCIATION_ID>

# EC2 instance without a public IP to avoid being internet-facing
resource "aws_instance" "<example_resource_name>" {
  ami           = "<example_ami_id>"
  instance_type = "t3.micro"
  associate_public_ip_address = false  # Critical: disables public IPv4 so the instance is not internet-facing
}

# CloudFormation: EC2 instance without a public IP to avoid being internet-facing
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: <example_ami_id>
      InstanceType: t3.micro
      NetworkInterfaces:
        - DeviceIndex: 0
          SubnetId: <example_resource_id>
          AssociatePublicIpAddress: false  # Critical: disables public IPv4 so the instance is not internet-facing

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_internet_facing_with_instance_profile. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires