Check ID: ec2_instance_managed_by_ssm
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: node-security
Resource type: AwsEc2Instance
What this check verifies
EC2 instances are assessed for enrollment as Systems Manager managed nodes. Running instances lacking Systems Manager registration are marked as unmanaged; instances in stopped, terminated, or pending states are noted separately.
Risk
Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.
Recommendation
Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.
CLI
Terraform
Native IaC
Dashboard steps
aws ec2 stop-instances —instance-ids <INSTANCE_ID>
# Terraform: make the instance SSM-managed by attaching the required IAM role
resource "aws_iam_role" "<example_resource_name>" {
name = "<example_resource_name>"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = { Service = "ec2.amazonaws.com" }
Action = "sts:AssumeRole"
}]
})
}
resource "aws_iam_role_policy_attachment" "<example_resource_name>_ssm" {
role = aws_iam_role.<example_resource_name>.name
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" # CRITICAL: grants SSM permissions required for management
}
resource "aws_iam_instance_profile" "<example_resource_name>" {
name = "<example_resource_name>"
role = aws_iam_role.<example_resource_name>.name
}
resource "aws_instance" "<example_resource_name>" {
ami = "ami-<example_resource_id>"
instance_type = "t3.micro"
iam_instance_profile = aws_iam_instance_profile.<example_resource_name>.name # CRITICAL: attaches the SSM-enabled role to the instance
}
# CloudFormation: make the instance SSM-managed by attaching the required IAM role
Resources:
<example_resource_name>Role:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: ec2.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore # CRITICAL: grants SSM permissions required for management
<example_resource_name>InstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Roles:
- !Ref <example_resource_name>Role
<example_resource_name>Instance:
Type: AWS::EC2::Instance
Properties:
ImageId: ami-<example_resource_id>
InstanceType: t3.micro
IamInstanceProfile: !Ref <example_resource_name>InstanceProfile # CRITICAL: attaches the SSM-enabled role to the instance
- In IAM console: Create role > AWS service > EC2 > Next; attach policy “AmazonSSMManagedInstanceCore”; Create role
- In EC2 console: Instances > select the instance > Actions > Security > Modify IAM role > choose the role created above > Update IAM role
- Wait a few minutes; in Systems Manager console: Managed nodes, verify the instance shows as Online
- If the instance OS does not include SSM Agent by default, install the SSM Agent for that OS, then verify again
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_managed_by_ssm. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks
